Add missing NULL pointer check for CapsuleNameBufStart.
Also add comments to notice that capsule name integrity check assumes
the capsule has been validated by IsValidCapsuleHeader().
Cc: Jian J Wang <jian.j.w...@intel.com>
Cc: Hao A Wu <hao.a...@intel.com>
Cc: Chao B Zhang <chao.b.zh...@intel.com>
Signed-off-by: Wei6 Xu <wei6...@intel.com>
---
MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c
b/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c
index 66c9be8e1f..3193ca8f4d 100644
--- a/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c
+++ b/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c
@@ -23,10 +23,13 @@ IsCapsuleNameCapsule (
/**
Check the integrity of the capsule name capsule.
If the capsule is vaild, return the physical address of each capsule name
string.
+ This routine assumes the capsule has been validated by
IsValidCapsuleHeader(), so
+ capsule memory overflow is not going to happen in this routine.
+
@param[in] CapsuleHeader Pointer to the capsule header of a capsule name
capsule.
@param[out] CapsuleNameNum Number of capsule name.
@retval NULL Capsule name capsule is not valid.
@retval CapsuleNameBuf Array of capsule name physical address.
@@ -63,10 +66,13 @@ ValidateCapsuleNameCapsuleIntegrity (
//
// If strings are not aligned on a 16-bit boundary, reallocate memory for it.
//
if (((UINTN) CapsuleNameBufStart & BIT0) != 0) {
CapsuleNameBufStart = AllocateCopyPool (CapsuleHeader->CapsuleImageSize -
CapsuleHeader->HeaderSize, CapsuleNameBufStart);
+ if (CapsuleNameBufStart == NULL) {
+ return NULL;
+ }
}
CapsuleNameBufEnd = CapsuleNameBufStart + CapsuleHeader->CapsuleImageSize -
CapsuleHeader->HeaderSize;
CapsuleNamePtr = CapsuleNameBufStart;
--
2.16.2.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#42942): https://edk2.groups.io/g/devel/message/42942
Mute This Topic: https://groups.io/mt/32232931/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
