In IsDevicePathValid API, code should validate the device path buffer not exceed the input MaxSize before reference the path info.
Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Eric Dong <eric.d...@intel.com> Cc: Ruiyu Ni <ruiyu...@intel.com> --- .../UefiDevicePathLib.c | 24 +++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c index 5cc4b35..ae1000e 100644 --- a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c +++ b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c @@ -2,7 +2,7 @@ Library instance that implement UEFI Device Path Library class based on protocol gEfiDevicePathUtilitiesProtocolGuid. - Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR> + Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR> This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -103,25 +103,35 @@ IsDevicePathValid ( ASSERT (DevicePath != NULL); - for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) { + if (MaxSize == 0){ + MaxSize = MAX_UINTN; + } + + Size = 0; + Count = 0; + + while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) && \ + (MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) && \ + !IsDevicePathEnd (DevicePath)) { NodeLength = DevicePathNodeLength (DevicePath); if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) { return FALSE; } - if (MaxSize > 0) { - Size += NodeLength; - if (Size + END_DEVICE_PATH_LENGTH > MaxSize) { - return FALSE; - } + if (NodeLength > MAX_UINTN - Size) { + return FALSE; } + Size += NodeLength; + if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) { Count++; if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) { return FALSE; } } + + DevicePath = NextDevicePathNode (DevicePath); } // -- 2.6.4.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel