"3.1.1 Boot Manager Programming" in the UEFI 2.5 spec mandates that Boot#### and similar options contain EFI_LOAD_OPTION structures. The EFI_LOAD_OPTION structure encodes the fixed initial part of the payload, and we can (and should) use it to enforce a minimum size for variable contents.
This patch is meant as a safety improvement. Cc: Jaben Carsey <jaben.car...@intel.com> Cc: Ryan Harkin <ryan.har...@linaro.org> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Laszlo Ersek <ler...@redhat.com> --- ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c | 19 +++++++++++++++++++ ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni | 1 + 2 files changed, 20 insertions(+) diff --git a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c index 36d04d4..9955c9e 100644 --- a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c +++ b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c @@ -1052,6 +1052,7 @@ BcfgDisplayDump( CHAR16 *DevPathString; VOID *DevPath; UINTN Errors; + EFI_LOAD_OPTION *LoadOption; if (OrderCount == 0) { ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_BCFG_NONE), gShellBcfgHiiHandle, L"bcfg"); @@ -1090,6 +1091,24 @@ BcfgDisplayDump( goto Cleanup; } + // + // We expect the Attributes, FilePathListLength, and L'\0'-terminated + // Description fields to be present. + // + if (BufferSize < sizeof *LoadOption + sizeof (CHAR16)) { + ShellPrintHiiEx ( + -1, + -1, + NULL, + STRING_TOKEN (STR_BCFG_VAR_CORRUPT), + gShellBcfgHiiHandle, + L"bcfg", + VariableName + ); + ++Errors; + goto Cleanup; + } + if ((*(UINT16*)(Buffer+4)) != 0) { DevPath = AllocateZeroPool(*(UINT16*)(Buffer+4)); if (DevPath != NULL) { diff --git a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni index 25bd138..282494b 100644 --- a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni +++ b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni @@ -37,6 +37,7 @@ #string STR_GEN_OUT_MEM #language en-US "%H%s%N: Memory allocation was not successful.\r\n" #string STR_BCFG_WRITE_FAIL #language en-US "%H%s%N: Unable to write to '%H%s%N'\r\n" #string STR_BCFG_READ_FAIL #language en-US "%H%s%N: Unable to read from '%H%s%N'\r\n" +#string STR_BCFG_VAR_CORRUPT #language en-US "%H%s%N: Variable '%H%s%N' corrupt.\r\n" #string STR_BCFG_HANDLE #language en-US "%H%s%N: The handle [%H%02x%N] does not have DevicePath.\r\n" #string STR_BCFG_FILE #language en-US "%H%s%N: The file '%H%s%N' matches multiple files.\r\n" #string STR_BCFG_FILE_OPEN #language en-US "%H%s%N: The file '%H%s%N' did not open.\r\n" -- 1.8.3.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel