tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdePkg UefiDevicePathLibDevicePathProtocol: Validate before use. 

In IsDevicePathValid API, code should validate the device path
buffer not exceed the input MaxSize before reference the path
info.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
This commit is contained in:
Eric Dong 2016-10-12 20:34:05 +08:00 committed by Ruiyu Ni
parent e9fb71b299
commit d9c2c9540a
1 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
View File

@ -2,7 +2,7 @@
Library instance that implement UEFI Device Path Library class based on protocol Library instance that implement UEFI Device Path Library class based on protocol
gEfiDevicePathUtilitiesProtocolGuid. gEfiDevicePathUtilitiesProtocolGuid.
Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR> Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -103,25 +103,35 @@ IsDevicePathValid (
ASSERT (DevicePath != NULL); ASSERT (DevicePath != NULL);
for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) { if (MaxSize == 0){
MaxSize = MAX_UINTN;
}
Size = 0;
Count = 0;
while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) &&
(MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) &&
!IsDevicePathEnd (DevicePath)) {
NodeLength = DevicePathNodeLength (DevicePath); NodeLength = DevicePathNodeLength (DevicePath);
if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) { if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {
return FALSE; return FALSE;
} }
if (MaxSize > 0) { if (NodeLength > MAX_UINTN - Size) {
Size += NodeLength; return FALSE;
if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {
return FALSE;
}
} }
Size += NodeLength;
if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) { if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {
Count++; Count++;
if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) { if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) {
return FALSE; return FALSE;
} }
} }
DevicePath = NextDevicePathNode (DevicePath);
} }
// //