From beafabdae49c873adecdb7511dbebe9d4ff5c8f0 Mon Sep 17 00:00:00 2001 From: Nate DeSimone Date: Wed, 30 Aug 2023 07:51:43 -0700 Subject: MdeModulePkg: Fix memory leak in LocateHandleBuffer() REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4543 REF: https://uefi.org/specs/UEFI/2.10/07_Services_Boot_Services.html#efi-boot-services-locatehandlebuffer CoreLocateHandleBuffer() can in certain cases, return an error and not free an allocated buffer. This scenario occurs if the first call to InternalCoreLocateHandle() returns success and the second call returns an error. On a successful return, LocateHandleBuffer() passes ownership of the buffer to the caller. However, the UEFI specification is not explicit about what the expected ownership of this buffer is in the case of an error. However, it is heavily implied by the code example given in section 7.3.15 of v2.10 of the UEFI specificaton that if LocateHandleBuffer() returns a non-successful status code then the ownership of the buffer does NOT transfer to the caller. This code example explicitly refrains from calling FreePool() if LocateHandleBuffer() returns an error. From a practical standpoint, it is logical to assume that a non-successful status code indicates that no buffer of handles was ever allocated. Indeed, in most error cases, LocateHandleBuffer() does not go far enough to get to the point where a buffer is allocated. Therefore, all existing users of this API must already be coded to support the case of a non-successful status code resulting in an invalid handle buffer being returned. Therefore, this change will not cause any backwards compatibility issues with existing code. In conclusion, this boils down to a fix for a memory leak that also brings the behavior of our LocateHandleBuffer() implementation into alignment with the original intentions of the UEFI specification authors. Reviewed-by: Michael D Kinney Cc: Liming Gao Cc: Jian J Wang Cc: Dandan Bi Signed-off-by: Nate DeSimone --- MdeModulePkg/Core/Dxe/Hand/Locate.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'MdeModulePkg/Core/Dxe/Hand') diff --git a/MdeModulePkg/Core/Dxe/Hand/Locate.c b/MdeModulePkg/Core/Dxe/Hand/Locate.c index a29010a..8f20c63 100644 --- a/MdeModulePkg/Core/Dxe/Hand/Locate.c +++ b/MdeModulePkg/Core/Dxe/Hand/Locate.c @@ -1,7 +1,7 @@ /** @file Locate handle functions -Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
+Copyright (c) 2006 - 2023, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent **/ @@ -730,6 +730,10 @@ CoreLocateHandleBuffer ( *NumberHandles = BufferSize / sizeof (EFI_HANDLE); if (EFI_ERROR (Status)) { *NumberHandles = 0; + if (*Buffer != NULL) { + CoreFreePool (*Buffer); + *Buffer = NULL; + } } CoreReleaseProtocolLock (); -- cgit v1.1