From c95233b8525ca6828921affd1496146cff262e65 Mon Sep 17 00:00:00 2001 From: Doug Flick Date: Fri, 27 Sep 2024 12:08:55 -0700 Subject: MdePkg: Fix overflow issue in BasePeCoffLib The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is also a UINT32 value. The current code does not check for overflow when adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a check to ensure that the addition does not overflow. Signed-off-by: Doug Flick Authored-by: sriraamx gobichettipalayam --- MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'MdePkg') diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c index 86ff2e769b..128090d98e 100644 --- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c +++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c @@ -1054,7 +1054,7 @@ PeCoffLoaderRelocateImage ( RelocDir = &Hdr.Te->DataDirectory[0]; } - if ((RelocDir != NULL) && (RelocDir->Size > 0)) { + if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) { RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset); RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress ( ImageContext, -- cgit v1.2.3