MdeModulePkg/Variable: [CVE-2017-5753] Fix bounds check bypass

[mirror_edk2.git] / MdeModulePkg / Universal / Variable / RuntimeDxe / VariableSmm.c

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
index e495d971a08b1d8df69fddf05d92c9e80d9e40fd..6dc19c24dbc23276369a2da7bee091af93b17500 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
@@ -537,6 +537,12 @@ SmmVariableHandler (
         goto EXIT;\r
       }\r
 \r
+      //\r
+      // The MemoryLoadFence() call here is to ensure the previous range/content\r
+      // checks for the CommBuffer have been completed before the subsequent\r
+      // consumption of the CommBuffer content.\r
+      //\r
+      MemoryLoadFence ();\r
       if (SmmVariableHeader->NameSize < sizeof (CHAR16) || SmmVariableHeader->Name[SmmVariableHeader->NameSize/sizeof (CHAR16) - 1] != L'\0') {\r
         //\r
         // Make sure VariableName is A Null-terminated string.\r
@@ -631,6 +637,12 @@ SmmVariableHandler (
         goto EXIT;\r
       }\r
 \r
+      //\r
+      // The MemoryLoadFence() call here is to ensure the previous range/content\r
+      // checks for the CommBuffer have been completed before the subsequent\r
+      // consumption of the CommBuffer content.\r
+      //\r
+      MemoryLoadFence ();\r
       if (SmmVariableHeader->NameSize < sizeof (CHAR16) || SmmVariableHeader->Name[SmmVariableHeader->NameSize/sizeof (CHAR16) - 1] != L'\0') {\r
         //\r
         // Make sure VariableName is A Null-terminated string.\r
@@ -766,6 +778,12 @@ SmmVariableHandler (
         goto EXIT;\r
       }\r
 \r
+      //\r
+      // The MemoryLoadFence() call here is to ensure the previous range/content\r
+      // checks for the CommBuffer have been completed before the subsequent\r
+      // consumption of the CommBuffer content.\r
+      //\r
+      MemoryLoadFence ();\r
       if (CommVariableProperty->NameSize < sizeof (CHAR16) || CommVariableProperty->Name[CommVariableProperty->NameSize/sizeof (CHAR16) - 1] != L'\0') {\r
         //\r
         // Make sure VariableName is A Null-terminated string.\r