tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

UefiCpuPkg: PiSmmCpuDxeSmm: Check buffer size before accessing 

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3283

Current SMM Save State routine does not check the number of bytes to be
read, when it comse to read IO_INFO, before casting the incoming buffer
to EFI_SMM_SAVE_STATE_IO_INFO. This could potentially cause memory
corruption due to extra bytes are written out of buffer boundary.

This change adds a width check before copying IoInfo into output buffer.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>

Signed-off-by: Kun Qin <kuqin12@gmail.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-Id: <20210406195254.1018-2-kuqin12@gmail.com>
This commit is contained in:
Kun Qin 2021-04-06 12:52:54 -07:00 committed by mergify[bot]
parent 2072c22a0d
commit a7d8e28b29
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h
View File

@ -337,7 +337,7 @@ This function supports reading a CPU Save State register in SMBase relocation ha
@retval EFI_SUCCESS The register was read from Save State.
@retval EFI_NOT_FOUND The register is not defined for the Save State of Processor.
@retval EFI_INVALID_PARAMETER This or Buffer is NULL.
@retval EFI_INVALID_PARAMETER Buffer is NULL, or Width does not meet requirement per Register type.
**/
EFI_STATUS

9
UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
View File

@ -343,7 +343,7 @@ ReadSaveStateRegisterByIndex (
@retval EFI_SUCCESS The register was read from Save State.
@retval EFI_NOT_FOUND The register is not defined for the Save State of Processor.
@retval EFI_INVALID_PARAMETER This or Buffer is NULL.
@retval EFI_INVALID_PARAMETER Buffer is NULL, or Width does not meet requirement per Register type.
**/
EFI_STATUS
@ -418,6 +418,13 @@ ReadSaveStateRegister (
return EFI_NOT_FOUND;
}
//
// Make sure the incoming buffer is large enough to hold IoInfo before accessing
//
if (Width < sizeof (EFI_SMM_SAVE_STATE_IO_INFO)) {
return EFI_INVALID_PARAMETER;
}
//
// Zero the IoInfo structure that will be returned in Buffer
//