diff options
| author | vanjeff <vanjeff@6f19259b-4bc3-4df7-8a09-765794883524> | 2013-05-22 01:21:58 +0000 |
|---|---|---|
| committer | vanjeff <vanjeff@6f19259b-4bc3-4df7-8a09-765794883524> | 2013-05-22 01:21:58 +0000 |
| commit | ab808b9728e5c8981cc772021b068f01dde4f800 (patch) | |
| tree | 11fa4ee1ddccd90e64d0d185ac6080fdd9ede29e /SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c | |
| parent | 84624448705af06435ef2ae184594f619be6599c (diff) | |
| download | edk2-ab808b9728e5c8981cc772021b068f01dde4f800.zip edk2-ab808b9728e5c8981cc772021b068f01dde4f800.tar.gz edk2-ab808b9728e5c8981cc772021b068f01dde4f800.tar.bz2 | |
Sync patch r14379 from main trunk.
Fix the TOCTOU issue of CommBufferSize itself for SMM communicate handler input.
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/branches/UDK2010.SR1@14382 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c')
| -rw-r--r-- | SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c index 754ab9a..0a16d71 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c @@ -458,6 +458,7 @@ SmmVariableHandler ( UINTN InfoSize;
UINTN NameBufferSize;
UINTN CommBufferPayloadSize;
+ UINTN TempCommBufferSize;
//
// If input is invalid, stop processing this SMI
@@ -466,17 +467,19 @@ SmmVariableHandler ( return EFI_SUCCESS;
}
- if (*CommBufferSize < SMM_VARIABLE_COMMUNICATE_HEADER_SIZE) {
+ TempCommBufferSize = *CommBufferSize;
+
+ if (TempCommBufferSize < SMM_VARIABLE_COMMUNICATE_HEADER_SIZE) {
DEBUG ((EFI_D_ERROR, "SmmVariableHandler: SMM communication buffer size invalid!\n"));
return EFI_SUCCESS;
}
- CommBufferPayloadSize = *CommBufferSize - SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
+ CommBufferPayloadSize = TempCommBufferSize - SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
if (CommBufferPayloadSize > mVariableBufferPayloadSize) {
DEBUG ((EFI_D_ERROR, "SmmVariableHandler: SMM communication buffer payload size invalid!\n"));
return EFI_SUCCESS;
}
- if (!InternalIsAddressValid ((UINTN)CommBuffer, *CommBufferSize)) {
+ if (!InternalIsAddressValid ((UINTN)CommBuffer, TempCommBufferSize)) {
DEBUG ((EFI_D_ERROR, "SmmVariableHandler: SMM communication buffer in SMRAM or overflow!\n"));
return EFI_SUCCESS;
}
@@ -656,7 +659,7 @@ SmmVariableHandler ( case SMM_VARIABLE_FUNCTION_GET_STATISTICS:
VariableInfo = (VARIABLE_INFO_ENTRY *) SmmVariableFunctionHeader->Data;
- InfoSize = *CommBufferSize - SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
+ InfoSize = TempCommBufferSize - SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
//
// Do not need to check SmmVariableFunctionHeader->Data in SMRAM here.
|