CryptoPkg/BaseCryptLib: Fix potential integer overflow issue.

[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / SysCall / RuntimeMemAllocation.c

diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c b/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c
index 0761e46e15f3df1c34f4c47d1a4c18e179742ad6..92bb9ddccdb9e64998aa0eee7e21d6938cbfaa8e 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c
+++ b/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c
@@ -2,7 +2,7 @@
   Light-weight Memory Management Routines for OpenSSL-based Crypto\r
   Library at Runtime Phase.\r
 \r
-Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -13,9 +13,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 **/\r
 \r
-#include <OpenSslSupport.h>\r
+#include <CrtLibSupport.h>\r
 #include <Library/UefiBootServicesTableLib.h>\r
 #include <Library/UefiRuntimeLib.h>\r
+#include <Library/MemoryAllocationLib.h>\r
 #include <Guid/EventGroup.h>\r
 \r
 //----------------------------------------------------------------\r
@@ -64,7 +65,7 @@ RT_MEMORY_PAGE_TABLE  *mRTPageTable = NULL;
 //\r
 // Event for Runtime Address Conversion.\r
 //\r
-EFI_EVENT             mVirtualAddressChangeEvent;\r
+STATIC EFI_EVENT      mVirtualAddressChangeEvent;\r
 \r
 \r
 /**\r
@@ -140,6 +141,12 @@ LookupFreeMemRegion (
 \r
   StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->LastEmptyPageOffset);\r
   ReqPages       = RT_SIZE_TO_PAGES (AllocationSize);\r
+  if (ReqPages > mRTPageTable->PageCount) {\r
+    //\r
+    // No enough region for object allocation.\r
+    //\r
+    return (UINTN)(-1);\r
+  }\r
 \r
   //\r
   // Look up the free memory region with in current memory map table.\r
@@ -175,6 +182,12 @@ LookupFreeMemRegion (
   // Look up the free memory region from the beginning of the memory table\r
   // until the StartCursorOffset\r
   //\r
+  if (ReqPages > StartPageIndex) {\r
+    //\r
+    // No enough region for object allocation.\r
+    //\r
+    return (UINTN)(-1);\r
+  }\r
   for (Index = 0; Index < (StartPageIndex - ReqPages); ) {\r
     //\r
     // Check Consecutive ReqPages Pages.\r
@@ -204,7 +217,7 @@ LookupFreeMemRegion (
   }\r
 \r
   //\r
-  // No availabe region for object allocation!\r
+  // No available region for object allocation!\r
   //\r
   return (UINTN)(-1);\r
 }\r
@@ -282,7 +295,7 @@ RuntimeFreeMem (
   UINTN  StartOffset;\r
   UINTN  StartPageIndex;\r
 \r
-  StartOffset    = (UINTN) ((UINT8 *)Buffer - mRTPageTable->DataAreaBase);\r
+  StartOffset    = (UINTN)Buffer - (UINTN)mRTPageTable->DataAreaBase;\r
   StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->Pages[RT_SIZE_TO_PAGES(StartOffset)].StartPageOffset);\r
 \r
   while (StartPageIndex < mRTPageTable->PageCount) {\r
@@ -385,7 +398,7 @@ RuntimeCryptLibConstructor (
 /* Allocates memory blocks */\r
 void *malloc (size_t size)\r
 {\r
-  return RuntimeAllocateMem ((UINTN)size);\r
+  return RuntimeAllocateMem ((UINTN) size);\r
 }\r
 \r
 /* Reallocate memory blocks */\r
@@ -396,10 +409,14 @@ void *realloc (void *ptr, size_t size)
   UINTN  StartPageIndex;\r
   UINTN  PageCount;\r
 \r
+  if (ptr == NULL) {\r
+    return malloc (size);\r
+  }\r
+\r
   //\r
   // Get Original Size of ptr\r
   //\r
-  StartOffset    = (UINTN) ((UINT8 *)ptr - mRTPageTable->DataAreaBase);\r
+  StartOffset    = (UINTN)ptr - (UINTN)mRTPageTable->DataAreaBase;\r
   StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->Pages[RT_SIZE_TO_PAGES (StartOffset)].StartPageOffset);\r
   PageCount      = 0;\r
   while (StartPageIndex < mRTPageTable->PageCount) {\r
@@ -434,5 +451,11 @@ void *realloc (void *ptr, size_t size)
 /* Deallocates or frees a memory block */\r
 void free (void *ptr)\r
 {\r
-  RuntimeFreeMem (ptr);\r
+  //\r
+  // In Standard C, free() handles a null pointer argument transparently. This\r
+  // is not true of RuntimeFreeMem() below, so protect it.\r
+  //\r
+  if (ptr != NULL) {\r
+    RuntimeFreeMem (ptr);\r
+  }\r
 }\r