From 0a1a0512e39c2ea5eb52787ad2f3e9de3e3a4239 Mon Sep 17 00:00:00 2001 From: Harry Liebel Date: Fri, 15 Feb 2013 19:42:44 +0000 Subject: Fix buffer overflow Data Abort. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Harry Liebel Signed-off-by: Olivier Martin - The removed code adjusts the load address of data inside a allocated buffer. The buffer is specifically allocated for this data and is the destination for moving modules to RAM. The buffer is page sized and aligned, - If the payload id very close to filling the page multiple buffer and is then adjusted the copy will spill onto data below the allocated buffer. --- MdeModulePkg/Core/Pei/Image/Image.c | 9 --------- 1 files changed, 0 insertions(+), 9 deletions(-) diff --git a/MdeModulePkg/Core/Pei/Image/Image.c b/MdeModulePkg/Core/Pei/Image/Image.c index 41069e7..de44eee 100644 --- a/MdeModulePkg/Core/Pei/Image/Image.c +++ b/MdeModulePkg/Core/Pei/Image/Image.c @@ -393,15 +393,6 @@ LoadAndRelocatePeCoffImage ( if (ImageContext.ImageAddress == 0) { return EFI_OUT_OF_RESOURCES; } - - // - // Skip the reserved space for the stripped PeHeader when load TeImage into memory. - // - if (ImageContext.IsTeImage) { - ImageContext.ImageAddress = ImageContext.ImageAddress + - ((EFI_TE_IMAGE_HEADER *) Pe32Data)->StrippedSize - - sizeof (EFI_TE_IMAGE_HEADER); - } } // -- 1.7.0.4