tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-28 16:14:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg: Fix buffer overflow in MergeMemoryMap

Browse Source 
Check that the next map entry is valid before dereferencing to merge the
guard pages. If the final entry is at the end of a page with no valid page
following it, then this can cause an access violation.

Signed-off-by: Kenneth Lautner <kenlautner3@gmail.com>
This commit is contained in:
Ken Lautner 2024-08-28 10:55:09 -07:00 committed by mergify[bot]
parent a9b38305b6
commit 964c22b8ea
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c
View File

@ -395,11 +395,14 @@ MergeMemoryMap (
NewMemoryMapEntry = MemoryMap; NewMemoryMapEntry = MemoryMap;
MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *)((UINT8 *)MemoryMap + *MemoryMapSize); MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *)((UINT8 *)MemoryMap + *MemoryMapSize);
while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) { while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {
CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof (EFI_MEMORY_DESCRIPTOR)); CopyMem (NewMemoryMapEntry, MemoryMapEntry, DescriptorSize);
NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize); NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);
do { do {
MergeGuardPages (NewMemoryMapEntry, NextMemoryMapEntry->PhysicalStart); if ((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) {
MergeGuardPages (NewMemoryMapEntry, NextMemoryMapEntry->PhysicalStart);
}
MemoryBlockLength = LShiftU64 (NewMemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT); MemoryBlockLength = LShiftU64 (NewMemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT);
if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) && if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&
(NewMemoryMapEntry->Type == NextMemoryMapEntry->Type) && (NewMemoryMapEntry->Type == NextMemoryMapEntry->Type) &&