tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg: Fix potential integer overflow issue 

In certain rare circumstance, the data passed from outside of SMM may be
invalid resulting the integer overflow. The issue are found by code review.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17908 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Ruiyu Ni 2015-07-10 02:16:42 +00:00 committed by niruiyu
parent d7fc5cfd68
commit 579b5ef204
2 changed files with 20 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
MdeModulePkg/Library/SmmCorePerformanceLib/SmmCorePerformanceLib.c
View File

@ -482,7 +482,8 @@ SmmPerformanceHandlerEx (
EFI_STATUS Status;
SMM_PERF_COMMUNICATE_EX *SmmPerfCommData;
GAUGE_DATA_ENTRY_EX *GaugeEntryExArray;
UINTN DataSize;
UINT64 DataSize;
UINTN Index;
GAUGE_DATA_ENTRY_EX *GaugeDataEx;
UINTN NumberOfEntries;
UINTN LogEntryKey;
@ -521,7 +522,7 @@ SmmPerformanceHandlerEx (
NumberOfEntries = SmmPerfCommData->NumberOfEntries;
LogEntryKey = SmmPerfCommData->LogEntryKey;
if (GaugeDataEx == NULL || NumberOfEntries == 0 || LogEntryKey > mGaugeData->NumberOfEntries ||
NumberOfEntries > mGaugeData->NumberOfEntries || (LogEntryKey + NumberOfEntries) > mGaugeData->NumberOfEntries) {
NumberOfEntries > mGaugeData->NumberOfEntries || LogEntryKey > (mGaugeData->NumberOfEntries - NumberOfEntries)) {
Status = EFI_INVALID_PARAMETER;
break;
}
@ -529,7 +530,7 @@ SmmPerformanceHandlerEx (
//
// Sanity check
//
DataSize = NumberOfEntries * sizeof(GAUGE_DATA_ENTRY_EX);
DataSize = MultU64x32 (NumberOfEntries, sizeof(GAUGE_DATA_ENTRY_EX));
if (!SmmIsBufferOutsideSmmValid ((UINTN) GaugeDataEx, DataSize)) {
DEBUG ((EFI_D_ERROR, "SmmPerformanceHandlerEx: SMM Performance Data buffer in SMRAM or overflow!\n"));
Status = EFI_ACCESS_DENIED;
@ -537,11 +538,14 @@ SmmPerformanceHandlerEx (
}
GaugeEntryExArray = (GAUGE_DATA_ENTRY_EX *) (mGaugeData + 1);
for (Index = 0; Index < NumberOfEntries; Index++) {
CopyMem (
(UINT8 *) GaugeDataEx,
(UINT8 *) &GaugeEntryExArray[LogEntryKey],
DataSize
(UINT8 *) &GaugeDataEx[Index],
(UINT8 *) &GaugeEntryExArray[LogEntryKey++],
sizeof (GAUGE_DATA_ENTRY_EX)
);
}
Status = EFI_SUCCESS;
break;
@ -590,7 +594,7 @@ SmmPerformanceHandler (
EFI_STATUS Status;
SMM_PERF_COMMUNICATE *SmmPerfCommData;
GAUGE_DATA_ENTRY_EX *GaugeEntryExArray;
UINTN DataSize;
UINT64 DataSize;
UINTN Index;
GAUGE_DATA_ENTRY *GaugeData;
UINTN NumberOfEntries;
@ -630,7 +634,7 @@ SmmPerformanceHandler (
NumberOfEntries = SmmPerfCommData->NumberOfEntries;
LogEntryKey = SmmPerfCommData->LogEntryKey;
if (GaugeData == NULL || NumberOfEntries == 0 || LogEntryKey > mGaugeData->NumberOfEntries ||
NumberOfEntries > mGaugeData->NumberOfEntries || (LogEntryKey + NumberOfEntries) > mGaugeData->NumberOfEntries) {
NumberOfEntries > mGaugeData->NumberOfEntries || LogEntryKey > (mGaugeData->NumberOfEntries - NumberOfEntries)) {
Status = EFI_INVALID_PARAMETER;
break;
}
@ -638,7 +642,7 @@ SmmPerformanceHandler (
//
// Sanity check
//
DataSize = NumberOfEntries * sizeof(GAUGE_DATA_ENTRY);
DataSize = MultU64x32 (NumberOfEntries, sizeof(GAUGE_DATA_ENTRY));
if (!SmmIsBufferOutsideSmmValid ((UINTN) GaugeData, DataSize)) {
DEBUG ((EFI_D_ERROR, "SmmPerformanceHandler: SMM Performance Data buffer in SMRAM or overflow!\n"));
Status = EFI_ACCESS_DENIED;

3
MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxSmmLib.c
View File

@ -1,6 +1,6 @@
/** @file
Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>
Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions
@ -394,6 +394,7 @@ UpdateLockBox (
DEBUG ((EFI_D_INFO, "SmmLockBoxSmmLib UpdateLockBox - Exit (%r)\n", EFI_BUFFER_TOO_SMALL));
return EFI_BUFFER_TOO_SMALL;
}
ASSERT ((UINTN)LockBox->SmramBuffer <= (MAX_ADDRESS - Offset));
CopyMem ((VOID *)((UINTN)LockBox->SmramBuffer + Offset), Buffer, Length);
//