Revision: 16433
          http://sourceforge.net/p/edk2/code/16433
Author:   vanjeff
Date:     2014-11-25 07:31:26 +0000 (Tue, 25 Nov 2014)
Log Message:
-----------
Sync patch r16280 from main trunk.

MdeModulePkg/SecurityPkg Variable: Add boundary check for while 
(IsValidVariableHeader (Variable)).

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <[email protected]>
Reviewed-by: Jiewen Yao <[email protected]>

Revision Links:
--------------
    http://sourceforge.net/p/edk2/code/16280

Modified Paths:
--------------
    branches/UDK2014.SP1/MdeModulePkg/Universal/Variable/Pei/Variable.c
    branches/UDK2014.SP1/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
    branches/UDK2014.SP1/SecurityPkg/VariableAuthenticated/Pei/Variable.c
    branches/UDK2014.SP1/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c

Modified: branches/UDK2014.SP1/MdeModulePkg/Universal/Variable/Pei/Variable.c
===================================================================
--- branches/UDK2014.SP1/MdeModulePkg/Universal/Variable/Pei/Variable.c 
2014-11-25 07:25:08 UTC (rev 16432)
+++ branches/UDK2014.SP1/MdeModulePkg/Universal/Variable/Pei/Variable.c 
2014-11-25 07:31:26 UTC (rev 16433)
@@ -3,7 +3,7 @@
   Implement ReadOnly Variable Services required by PEIM and install
   PEI ReadOnly Varaiable2 PPI. These services operates the non volatile 
storage space.
 
-Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD 
License
 which accompanies this distribution.  The full text of the license may be 
found at
@@ -547,14 +547,25 @@
   EFI_HOB_GUID_TYPE     *GuidHob;
   UINTN                 PartialHeaderSize;
 
+  if (Variable == NULL) {
+    return FALSE;
+  }
+
    //
    // First assume variable header pointed by Variable is consecutive.
    //
   *VariableHeader = Variable;
 
-  if ((Variable != NULL) && (StoreInfo->FtwLastWriteData != NULL)) {
+  if (StoreInfo->FtwLastWriteData != NULL) {
     TargetAddress = StoreInfo->FtwLastWriteData->TargetAddress;
     SpareAddress = StoreInfo->FtwLastWriteData->SpareAddress;
+    if (((UINTN) Variable > (UINTN) SpareAddress) &&
+        (((UINTN) Variable - (UINTN) SpareAddress + (UINTN) TargetAddress) >= 
(UINTN) GetEndPointer (StoreInfo->VariableStoreHeader))) {
+      //
+      // Reach the end of variable store.
+      //
+      return FALSE;
+    }
     if (((UINTN) Variable < (UINTN) TargetAddress) && (((UINTN) Variable + 
sizeof (VARIABLE_HEADER)) > (UINTN) TargetAddress)) {
       //
       // Variable header pointed by Variable is inconsecutive,
@@ -576,6 +587,13 @@
         CopyMem ((UINT8 *) *VariableHeader + PartialHeaderSize, (UINT8 *) 
(UINTN) SpareAddress, sizeof (VARIABLE_HEADER) - PartialHeaderSize);
       }
     }
+  } else {
+    if (Variable >= GetEndPointer (StoreInfo->VariableStoreHeader)) {
+      //
+      // Reach the end of variable store.
+      //
+      return FALSE;
+    }
   }
 
   return IsValidVariableHeader (*VariableHeader);

Modified: 
branches/UDK2014.SP1/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
===================================================================
--- branches/UDK2014.SP1/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c  
2014-11-25 07:25:08 UTC (rev 16432)
+++ branches/UDK2014.SP1/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c  
2014-11-25 07:31:26 UTC (rev 16433)
@@ -190,18 +190,24 @@
 
   This code checks if variable header is valid or not.
 
-  @param Variable        Pointer to the Variable Header.
+  @param Variable           Pointer to the Variable Header.
+  @param VariableStoreEnd   Pointer to the Variable Store End.
 
-  @retval TRUE           Variable header is valid.
-  @retval FALSE          Variable header is not valid.
+  @retval TRUE              Variable header is valid.
+  @retval FALSE             Variable header is not valid.
 
 **/
 BOOLEAN
 IsValidVariableHeader (
-  IN  VARIABLE_HEADER   *Variable
+  IN  VARIABLE_HEADER       *Variable,
+  IN  VARIABLE_HEADER       *VariableStoreEnd
   )
 {
-  if (Variable == NULL || Variable->StartId != VARIABLE_DATA) {
+  if ((Variable == NULL) || (Variable >= VariableStoreEnd) || 
(Variable->StartId != VARIABLE_DATA)) {
+    //
+    // Variable is NULL or has reached the end of variable store,
+    // or the StartId is not correct.
+    //
     return FALSE;
   }
 
@@ -499,10 +505,6 @@
 {
   UINTN Value;
 
-  if (!IsValidVariableHeader (Variable)) {
-    return NULL;
-  }
-
   Value =  (UINTN) GetVariableDataPtr (Variable);
   Value += DataSizeOfVariable (Variable);
   Value += GET_PAD_SIZE (DataSizeOfVariable (Variable));
@@ -622,7 +624,7 @@
     Variable          = GetStartPointer (VariableStoreHeader);
     MaximumBufferSize = sizeof (VARIABLE_STORE_HEADER);
 
-    while (IsValidVariableHeader (Variable)) {
+    while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
       NextVariable = GetNextVariablePtr (Variable);
       if ((Variable->State == VAR_ADDED || Variable->State == 
(VAR_IN_DELETED_TRANSITION & VAR_ADDED)) &&
           Variable != UpdatingVariable &&
@@ -672,7 +674,7 @@
   // Reinstall all ADDED variables as long as they are not identical to 
Updating Variable.
   // 
   Variable = GetStartPointer (VariableStoreHeader);
-  while (IsValidVariableHeader (Variable)) {
+  while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
     NextVariable = GetNextVariablePtr (Variable);
     if (Variable != UpdatingVariable && Variable->State == VAR_ADDED) {
       VariableSize = (UINTN) NextVariable - (UINTN) Variable;
@@ -691,7 +693,7 @@
   // Reinstall all in delete transition variables.
   // 
   Variable = GetStartPointer (VariableStoreHeader);
-  while (IsValidVariableHeader (Variable)) {
+  while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
     NextVariable = GetNextVariablePtr (Variable);
     if (Variable != UpdatingVariable && Variable != 
UpdatingInDeletedTransition && Variable->State == (VAR_IN_DELETED_TRANSITION & 
VAR_ADDED)) {
 
@@ -703,7 +705,7 @@
      
       FoundAdded = FALSE;
       AddedVariable = GetStartPointer ((VARIABLE_STORE_HEADER *) ValidBuffer);
-      while (IsValidVariableHeader (AddedVariable)) {
+      while (IsValidVariableHeader (AddedVariable, GetEndPointer 
((VARIABLE_STORE_HEADER *) ValidBuffer))) {
         NextAddedVariable = GetNextVariablePtr (AddedVariable);
         NameSize = NameSizeOfVariable (AddedVariable);
         if (CompareGuid (&AddedVariable->VendorGuid, &Variable->VendorGuid) &&
@@ -795,7 +797,7 @@
       mVariableModuleGlobal->CommonVariableTotalSize = CommonVariableTotalSize;
     } else {
       NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER 
*)(UINTN)VariableBase);
-      while (IsValidVariableHeader (NextVariable)) {
+      while (IsValidVariableHeader (NextVariable, GetEndPointer 
((VARIABLE_STORE_HEADER *)(UINTN)VariableBase))) {
         VariableSize = NextVariable->NameSize + NextVariable->DataSize + 
sizeof (VARIABLE_HEADER);
         if ((Variable->Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == 
EFI_VARIABLE_HARDWARE_ERROR_RECORD) {
           mVariableModuleGlobal->HwErrVariableTotalSize += HEADER_ALIGN 
(VariableSize);
@@ -853,7 +855,7 @@
   InDeletedVariable  = NULL;
 
   for ( PtrTrack->CurrPtr = PtrTrack->StartPtr
-      ; (PtrTrack->CurrPtr < PtrTrack->EndPtr) && IsValidVariableHeader 
(PtrTrack->CurrPtr)
+      ; IsValidVariableHeader (PtrTrack->CurrPtr, PtrTrack->EndPtr)
       ; PtrTrack->CurrPtr = GetNextVariablePtr (PtrTrack->CurrPtr)
       ) {
     if (PtrTrack->CurrPtr->State == VAR_ADDED || 
@@ -2408,10 +2410,7 @@
     //
     // Switch from Volatile to HOB, to Non-Volatile.
     //
-    while ((Variable.CurrPtr >= Variable.EndPtr) ||
-           (Variable.CurrPtr == NULL)            ||
-           !IsValidVariableHeader (Variable.CurrPtr)
-          ) {
+    while (!IsValidVariableHeader (Variable.CurrPtr, Variable.EndPtr)) {
       //
       // Find current storage index
       //
@@ -2617,8 +2616,7 @@
     // Parse non-volatile variable data and get last variable offset.
     //
     NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point);
-    while ((NextVariable < GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) 
Point)) 
-        && IsValidVariableHeader (NextVariable)) {
+    while (IsValidVariableHeader (NextVariable, GetEndPointer 
((VARIABLE_STORE_HEADER *) (UINTN) Point))) {
       NextVariable = GetNextVariablePtr (NextVariable);
     }
     mVariableModuleGlobal->NonVolatileLastVariableOffset = (UINTN) 
NextVariable - (UINTN) Point;
@@ -2765,7 +2763,7 @@
   //
   // Now walk through the related variable store.
   //
-  while ((Variable < GetEndPointer (VariableStoreHeader)) && 
IsValidVariableHeader (Variable)) {
+  while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
     NextVariable = GetNextVariablePtr (Variable);
     VariableSize = (UINT64) (UINTN) NextVariable - (UINT64) (UINTN) Variable;
 
@@ -3063,7 +3061,7 @@
   // Parse non-volatile variable data and get last variable offset.
   //
   NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER 
*)(UINTN)VariableStoreBase);
-  while (IsValidVariableHeader (NextVariable)) {
+  while (IsValidVariableHeader (NextVariable, GetEndPointer 
((VARIABLE_STORE_HEADER *)(UINTN)VariableStoreBase))) {
     VariableSize = NextVariable->NameSize + NextVariable->DataSize + sizeof 
(VARIABLE_HEADER);
     if ((NextVariable->Attributes & (EFI_VARIABLE_NON_VOLATILE | 
EFI_VARIABLE_HARDWARE_ERROR_RECORD)) == (EFI_VARIABLE_NON_VOLATILE | 
EFI_VARIABLE_HARDWARE_ERROR_RECORD)) {
       mVariableModuleGlobal->HwErrVariableTotalSize += HEADER_ALIGN 
(VariableSize);
@@ -3109,7 +3107,7 @@
     //
     mVariableModuleGlobal->VariableGlobal.HobVariableBase = 0;
     for ( Variable = GetStartPointer (VariableStoreHeader)
-        ; (Variable < GetEndPointer (VariableStoreHeader) && 
IsValidVariableHeader (Variable))
+        ; IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))
         ; Variable = GetNextVariablePtr (Variable)
         ) {
       if (Variable->State != VAR_ADDED) {

Modified: branches/UDK2014.SP1/SecurityPkg/VariableAuthenticated/Pei/Variable.c
===================================================================
--- branches/UDK2014.SP1/SecurityPkg/VariableAuthenticated/Pei/Variable.c       
2014-11-25 07:25:08 UTC (rev 16432)
+++ branches/UDK2014.SP1/SecurityPkg/VariableAuthenticated/Pei/Variable.c       
2014-11-25 07:31:26 UTC (rev 16433)
@@ -3,7 +3,7 @@
   ReadOnly Varaiable2 PPI. These services operates the non-volatile 
   storage space.
 
-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials 
 are licensed and made available under the terms and conditions of the BSD 
License 
 which accompanies this distribution.  The full text of the license may be 
found at 
@@ -546,14 +546,25 @@
   EFI_HOB_GUID_TYPE     *GuidHob;
   UINTN                 PartialHeaderSize;
 
+  if (Variable == NULL) {
+    return FALSE;
+  }
+
    //
    // First assume variable header pointed by Variable is consecutive.
    //
   *VariableHeader = Variable;
 
-  if ((Variable != NULL) && (StoreInfo->FtwLastWriteData != NULL)) {
+  if (StoreInfo->FtwLastWriteData != NULL) {
     TargetAddress = StoreInfo->FtwLastWriteData->TargetAddress;
     SpareAddress = StoreInfo->FtwLastWriteData->SpareAddress;
+    if (((UINTN) Variable > (UINTN) SpareAddress) &&
+        (((UINTN) Variable - (UINTN) SpareAddress + (UINTN) TargetAddress) >= 
(UINTN) GetEndPointer (StoreInfo->VariableStoreHeader))) {
+      //
+      // Reach the end of variable store.
+      //
+      return FALSE;
+    }
     if (((UINTN) Variable < (UINTN) TargetAddress) && (((UINTN) Variable + 
sizeof (VARIABLE_HEADER)) > (UINTN) TargetAddress)) {
       //
       // Variable header pointed by Variable is inconsecutive,
@@ -575,6 +586,13 @@
         CopyMem ((UINT8 *) *VariableHeader + PartialHeaderSize, (UINT8 *) 
(UINTN) SpareAddress, sizeof (VARIABLE_HEADER) - PartialHeaderSize);
       }
     }
+  } else {
+    if (Variable >= GetEndPointer (StoreInfo->VariableStoreHeader)) {
+      //
+      // Reach the end of variable store.
+      //
+      return FALSE;
+    }
   }
 
   return IsValidVariableHeader (*VariableHeader);

Modified: 
branches/UDK2014.SP1/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
===================================================================
--- 
branches/UDK2014.SP1/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c    
    2014-11-25 07:25:08 UTC (rev 16432)
+++ 
branches/UDK2014.SP1/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c    
    2014-11-25 07:31:26 UTC (rev 16433)
@@ -218,18 +218,24 @@
 
   This code checks if variable header is valid or not.
 
-  @param Variable        Pointer to the Variable Header.
+  @param Variable           Pointer to the Variable Header.
+  @param VariableStoreEnd   Pointer to the Variable Store End.
 
-  @retval TRUE           Variable header is valid.
-  @retval FALSE          Variable header is not valid.
+  @retval TRUE              Variable header is valid.
+  @retval FALSE             Variable header is not valid.
 
 **/
 BOOLEAN
 IsValidVariableHeader (
-  IN  VARIABLE_HEADER   *Variable
+  IN  VARIABLE_HEADER       *Variable,
+  IN  VARIABLE_HEADER       *VariableStoreEnd
   )
 {
-  if (Variable == NULL || Variable->StartId != VARIABLE_DATA) {
+  if ((Variable == NULL) || (Variable >= VariableStoreEnd) || 
(Variable->StartId != VARIABLE_DATA)) {
+    //
+    // Variable is NULL or has reached the end of variable store,
+    // or the StartId is not correct.
+    //
     return FALSE;
   }
 
@@ -529,10 +535,6 @@
 {
   UINTN Value;
 
-  if (!IsValidVariableHeader (Variable)) {
-    return NULL;
-  }
-
   Value =  (UINTN) GetVariableDataPtr (Variable);
   Value += DataSizeOfVariable (Variable);
   Value += GET_PAD_SIZE (DataSizeOfVariable (Variable));
@@ -605,14 +607,16 @@
   )
 {
   VARIABLE_HEADER          *Variable;
+  VARIABLE_HEADER          *VariableStoreEnd;
 
   if (PubKeyIndex > mPubKeyNumber) {
     return FALSE;
   }
-  
+
   Variable = GetStartPointer ((VARIABLE_STORE_HEADER *) (UINTN) 
mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);
-  
-  while (IsValidVariableHeader (Variable)) {
+  VariableStoreEnd = GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) 
mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);
+
+  while (IsValidVariableHeader (Variable, VariableStoreEnd)) {
     if ((Variable->State == VAR_ADDED || Variable->State == 
(VAR_IN_DELETED_TRANSITION & VAR_ADDED)) && 
         Variable->PubKeyIndex == PubKeyIndex) {
       return TRUE;
@@ -799,7 +803,7 @@
     Variable          = GetStartPointer (VariableStoreHeader);
     MaximumBufferSize = sizeof (VARIABLE_STORE_HEADER);
 
-    while (IsValidVariableHeader (Variable)) {
+    while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
       NextVariable = GetNextVariablePtr (Variable);
       if ((Variable->State == VAR_ADDED || Variable->State == 
(VAR_IN_DELETED_TRANSITION & VAR_ADDED)) &&
           Variable != UpdatingVariable &&
@@ -866,7 +870,7 @@
     // Refresh the PubKeyIndex for all valid variables (ADDED and 
IN_DELETED_TRANSITION).
     //
     Variable = GetStartPointer (VariableStoreHeader);
-    while (IsValidVariableHeader (Variable)) {
+    while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
       NextVariable = GetNextVariablePtr (Variable);
       if (Variable->State == VAR_ADDED || Variable->State == 
(VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {
         if ((StrCmp (GetVariableNamePtr (Variable), AUTHVAR_KEYDB_NAME) == 0) 
&& 
@@ -912,7 +916,7 @@
     // Reinstall all ADDED variables as long as they are not identical to 
Updating Variable.
     //
     Variable = GetStartPointer (VariableStoreHeader);
-    while (IsValidVariableHeader (Variable)) {
+    while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
       NextVariable = GetNextVariablePtr (Variable);
       if (Variable != UpdatingVariable && Variable->State == VAR_ADDED) {
         VariableSize = (UINTN) NextVariable - (UINTN) Variable;
@@ -931,7 +935,7 @@
     // Reinstall all in delete transition variables.
     //
     Variable = GetStartPointer (VariableStoreHeader);
-    while (IsValidVariableHeader (Variable)) {
+    while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
       NextVariable = GetNextVariablePtr (Variable);
       if (Variable != UpdatingVariable && Variable != 
UpdatingInDeletedTransition && Variable->State == (VAR_IN_DELETED_TRANSITION & 
VAR_ADDED)) {
 
@@ -943,7 +947,7 @@
 
         FoundAdded = FALSE;
         AddedVariable = GetStartPointer ((VARIABLE_STORE_HEADER *) 
ValidBuffer);
-        while (IsValidVariableHeader (AddedVariable)) {
+        while (IsValidVariableHeader (AddedVariable, GetEndPointer 
((VARIABLE_STORE_HEADER *) ValidBuffer))) {
           NextAddedVariable = GetNextVariablePtr (AddedVariable);
           NameSize = NameSizeOfVariable (AddedVariable);
           if (CompareGuid (&AddedVariable->VendorGuid, &Variable->VendorGuid) 
&&
@@ -1036,7 +1040,7 @@
       mVariableModuleGlobal->CommonVariableTotalSize = CommonVariableTotalSize;
     } else {
       NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER 
*)(UINTN)VariableBase);
-      while (IsValidVariableHeader (NextVariable)) {
+      while (IsValidVariableHeader (NextVariable, GetEndPointer 
((VARIABLE_STORE_HEADER *)(UINTN)VariableBase))) {
         VariableSize = NextVariable->NameSize + NextVariable->DataSize + 
sizeof (VARIABLE_HEADER);
         if ((Variable->Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == 
EFI_VARIABLE_HARDWARE_ERROR_RECORD) {
           mVariableModuleGlobal->HwErrVariableTotalSize += HEADER_ALIGN 
(VariableSize);
@@ -1102,7 +1106,7 @@
   InDeletedVariable  = NULL;
 
   for ( PtrTrack->CurrPtr = PtrTrack->StartPtr
-      ; (PtrTrack->CurrPtr < PtrTrack->EndPtr) && IsValidVariableHeader 
(PtrTrack->CurrPtr)
+      ; IsValidVariableHeader (PtrTrack->CurrPtr, PtrTrack->EndPtr)
       ; PtrTrack->CurrPtr = GetNextVariablePtr (PtrTrack->CurrPtr)
       ) {
     if (PtrTrack->CurrPtr->State == VAR_ADDED ||
@@ -2867,10 +2871,7 @@
     //
     // Switch from Volatile to HOB, to Non-Volatile.
     //
-    while ((Variable.CurrPtr >= Variable.EndPtr) ||
-           (Variable.CurrPtr == NULL)            ||
-           !IsValidVariableHeader (Variable.CurrPtr)
-          ) {
+    while (!IsValidVariableHeader (Variable.CurrPtr, Variable.EndPtr)) {
       //
       // Find current storage index
       //
@@ -3119,8 +3120,7 @@
     // Parse non-volatile variable data and get last variable offset.
     //
     NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point);
-    while ((NextVariable < GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) 
Point))
-        && IsValidVariableHeader (NextVariable)) {
+    while (IsValidVariableHeader (NextVariable, GetEndPointer 
((VARIABLE_STORE_HEADER *) (UINTN) Point))) {
       NextVariable = GetNextVariablePtr (NextVariable);
     }
     mVariableModuleGlobal->NonVolatileLastVariableOffset = (UINTN) 
NextVariable - (UINTN) Point;
@@ -3294,7 +3294,7 @@
   //
   // Now walk through the related variable store.
   //
-  while ((Variable < GetEndPointer (VariableStoreHeader)) && 
IsValidVariableHeader (Variable)) {
+  while (IsValidVariableHeader (Variable, GetEndPointer 
(VariableStoreHeader))) {
     NextVariable = GetNextVariablePtr (Variable);
     VariableSize = (UINT64) (UINTN) NextVariable - (UINT64) (UINTN) Variable;
 
@@ -3594,7 +3594,7 @@
   // Parse non-volatile variable data and get last variable offset.
   //
   NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER 
*)(UINTN)VariableStoreBase);
-  while (IsValidVariableHeader (NextVariable)) {
+  while (IsValidVariableHeader (NextVariable, GetEndPointer 
((VARIABLE_STORE_HEADER *)(UINTN)VariableStoreBase))) {
     VariableSize = NextVariable->NameSize + NextVariable->DataSize + sizeof 
(VARIABLE_HEADER);
     if ((NextVariable->Attributes & (EFI_VARIABLE_NON_VOLATILE | 
EFI_VARIABLE_HARDWARE_ERROR_RECORD)) == (EFI_VARIABLE_NON_VOLATILE | 
EFI_VARIABLE_HARDWARE_ERROR_RECORD)) {
       mVariableModuleGlobal->HwErrVariableTotalSize += HEADER_ALIGN 
(VariableSize);
@@ -3640,7 +3640,7 @@
     //
     mVariableModuleGlobal->VariableGlobal.HobVariableBase = 0;
     for ( Variable = GetStartPointer (VariableStoreHeader)
-        ; (Variable < GetEndPointer (VariableStoreHeader) && 
IsValidVariableHeader (Variable))
+        ; IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))
         ; Variable = GetNextVariablePtr (Variable)
         ) {
       if (Variable->State != VAR_ADDED) {


------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits

Reply via email to