In IsDevicePathValid API, code should validate the device path
buffer not exceed the input MaxSize before reference the path
info.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.d...@intel.com>
Cc: Ruiyu Ni <ruiyu...@intel.com>
---
.../UefiDevicePathLib/DevicePathUtilities.c | 25 ++++++++++++++++------
1 file changed, 18 insertions(+), 7 deletions(-)
diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
index 7f21a60..48743c5 100644
--- a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
+++ b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
@@ -8,7 +8,7 @@
environment varibles. Multi-instance device paths should never be placed
on a Handle.
- Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD
License
which accompanies this distribution. The full text of the license may be
found at
@@ -61,25 +61,35 @@ IsDevicePathValid (
ASSERT (DevicePath != NULL);
- for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath =
NextDevicePathNode (DevicePath)) {
+ if (MaxSize == 0){
+ MaxSize = MAX_UINTN;
+ }
+
+ Size = 0;
+ Count = 0;
+
+ while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) && \
+ (MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) && \
+ !IsDevicePathEnd (DevicePath)) {
NodeLength = DevicePathNodeLength (DevicePath);
if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {
return FALSE;
}
- if (MaxSize > 0) {
- Size += NodeLength;
- if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {
- return FALSE;
- }
+ if (NodeLength > MAX_UINTN - Size) {
+ return FALSE;
}
+ Size += NodeLength;
+
if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {
Count++;
if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) {
return FALSE;
}
}
+
+ DevicePath = NextDevicePathNode (DevicePath);
}
//
@@ -88,6 +98,7 @@ IsDevicePathValid (
return (BOOLEAN) (DevicePathNodeLength (DevicePath) ==
END_DEVICE_PATH_LENGTH);
}
+
/**
Returns the Type field of a device path node.
--
2.6.4.windows.1
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
