Fix potential overflow for SetVariable interface

[mirror_edk2.git] / MdeModulePkg / Universal / Variable / RuntimeDxe / Variable.c

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
index 956c1f2ae1682dc531cdb910e6bc856cc6afb4f2..cd3f5ef475dd21022ca1b9b60961f3bf0337869f 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
@@ -2218,14 +2218,20 @@ VariableServiceSetVariable (
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
+  if ((UINTN)(~0) - DataSize < StrSize(VariableName)){\r
+    //\r
+    // Prevent whole variable size overflow \r
+    // \r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   //\r
   //  The size of the VariableName, including the Unicode Null in bytes plus\r
   //  the DataSize is limited to maximum size of PcdGet32 (PcdMaxHardwareErrorVariableSize)\r
   //  bytes for HwErrRec, and PcdGet32 (PcdMaxVariableSize) bytes for the others.\r
   //\r
   if ((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == EFI_VARIABLE_HARDWARE_ERROR_RECORD) {\r
-    if ((DataSize > PcdGet32 (PcdMaxHardwareErrorVariableSize)) ||\r
-        (sizeof (VARIABLE_HEADER) + StrSize (VariableName) + DataSize > PcdGet32 (PcdMaxHardwareErrorVariableSize))) {\r
+    if ( StrSize (VariableName) + DataSize > PcdGet32 (PcdMaxHardwareErrorVariableSize) - sizeof (VARIABLE_HEADER)) {\r
       return EFI_INVALID_PARAMETER;\r
     }\r
     if (!IsHwErrRecVariable(VariableName, VendorGuid)) {\r
@@ -2236,8 +2242,7 @@ VariableServiceSetVariable (
     //  The size of the VariableName, including the Unicode Null in bytes plus\r
     //  the DataSize is limited to maximum size of PcdGet32 (PcdMaxVariableSize) bytes.\r
     //\r
-    if ((DataSize > PcdGet32 (PcdMaxVariableSize)) ||\r
-        (sizeof (VARIABLE_HEADER) + StrSize (VariableName) + DataSize > PcdGet32 (PcdMaxVariableSize))) {\r
+    if (StrSize (VariableName) + DataSize > PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER)) {\r
       return EFI_INVALID_PARAMETER;\r
     }  \r
   }\r