Revision: 19710
http://sourceforge.net/p/edk2/code/19710
Author: lersek
Date: 2016-01-21 18:40:09 +0000 (Thu, 21 Jan 2016)
Log Message:
-----------
ShellPkg: BcfgDisplayDump(): enforce minimum size for Boot#### and co.
"3.1.1 Boot Manager Programming" in the UEFI 2.5 spec mandates that
Boot#### and similar options contain EFI_LOAD_OPTION structures. The
EFI_LOAD_OPTION structure encodes the fixed initial part of the payload,
and we can (and should) use it to enforce a minimum size for variable
contents.
This patch is meant as a safety improvement.
Cc: Jaben Carsey <[email protected]>
Cc: Ryan Harkin <[email protected]>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <[email protected]>
Reviewed-by: Jaben Carsey <[email protected]>
Modified Paths:
--------------
trunk/edk2/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c
trunk/edk2/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni
Modified:
trunk/edk2/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c
===================================================================
---
trunk/edk2/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c
2016-01-21 18:40:05 UTC (rev 19709)
+++
trunk/edk2/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c
2016-01-21 18:40:09 UTC (rev 19710)
@@ -1052,6 +1052,7 @@
CHAR16 *DevPathString;
VOID *DevPath;
UINTN Errors;
+ EFI_LOAD_OPTION *LoadOption;
if (OrderCount == 0) {
ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_BCFG_NONE),
gShellBcfgHiiHandle, L"bcfg");
@@ -1090,6 +1091,24 @@
goto Cleanup;
}
+ //
+ // We expect the Attributes, FilePathListLength, and L'\0'-terminated
+ // Description fields to be present.
+ //
+ if (BufferSize < sizeof *LoadOption + sizeof (CHAR16)) {
+ ShellPrintHiiEx (
+ -1,
+ -1,
+ NULL,
+ STRING_TOKEN (STR_BCFG_VAR_CORRUPT),
+ gShellBcfgHiiHandle,
+ L"bcfg",
+ VariableName
+ );
+ ++Errors;
+ goto Cleanup;
+ }
+
if ((*(UINT16*)(Buffer+4)) != 0) {
DevPath = AllocateZeroPool(*(UINT16*)(Buffer+4));
if (DevPath != NULL) {
Modified:
trunk/edk2/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni
===================================================================
---
trunk/edk2/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni
2016-01-21 18:40:05 UTC (rev 19709)
+++
trunk/edk2/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni
2016-01-21 18:40:09 UTC (rev 19710)
@@ -37,6 +37,7 @@
#string STR_GEN_OUT_MEM #language en-US "%H%s%N: Memory allocation
was not successful.\r\n"
#string STR_BCFG_WRITE_FAIL #language en-US "%H%s%N: Unable to write to
'%H%s%N'\r\n"
#string STR_BCFG_READ_FAIL #language en-US "%H%s%N: Unable to read from
'%H%s%N'\r\n"
+#string STR_BCFG_VAR_CORRUPT #language en-US "%H%s%N: Variable '%H%s%N'
corrupt.\r\n"
#string STR_BCFG_HANDLE #language en-US "%H%s%N: The handle
[%H%02x%N] does not have DevicePath.\r\n"
#string STR_BCFG_FILE #language en-US "%H%s%N: The file '%H%s%N'
matches multiple files.\r\n"
#string STR_BCFG_FILE_OPEN #language en-US "%H%s%N: The file '%H%s%N'
did not open.\r\n"
------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
