Fix the potential address overflow issue when checking PE signature.

[mirror_edk2.git] / SourceLevelDebugPkg / Library / DebugAgent / DebugAgentCommon / DebugAgent.c

diff --git a/SourceLevelDebugPkg/Library/DebugAgent/DebugAgentCommon/DebugAgent.c b/SourceLevelDebugPkg/Library/DebugAgent/DebugAgentCommon/DebugAgent.c
index 239cf63f6b155ac864a3bc63f7ec26ac4eb1ac4d..f3da983946d6b66c6b6b849af387149b5ecf15d0 100644 (file)
--- a/SourceLevelDebugPkg/Library/DebugAgent/DebugAgentCommon/DebugAgent.c
+++ b/SourceLevelDebugPkg/Library/DebugAgent/DebugAgentCommon/DebugAgent.c
@@ -4,7 +4,7 @@
   read/write debug packet to communication with HOST based on transfer\r
   protocol.\r
 \r
-  Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r
@@ -19,7 +19,7 @@
 #include "Ia32/DebugException.h"\r
 \r
 CHAR8 mErrorMsgVersionAlert[]       = "\rThe SourceLevelDebugPkg you are using requires a newer version of the Intel(R) UDK Debugger Tool.\r\n";\r
-CHAR8 mErrorMsgSendInitPacket[]     = "\rSend INIT break packet and try to connect the HOST (Intel(R) UDK Debugger Tool v1.3.1) ...\r\n";\r
+CHAR8 mErrorMsgSendInitPacket[]     = "\rSend INIT break packet and try to connect the HOST (Intel(R) UDK Debugger Tool v1.4) ...\r\n";\r
 CHAR8 mErrorMsgConnectOK[]          = "HOST connection is successful!\r\n";\r
 CHAR8 mErrorMsgConnectFail[]        = "HOST connection is failed!\r\n";\r
 CHAR8 mWarningMsgIngoreBreakpoint[] = "Ignore break point in SMM for SMI issued during DXE debugging!\r\n";\r
@@ -214,10 +214,12 @@ FindAndReportModuleImageInfo (
     if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {\r
       //\r
       // DOS image header is present, so read the PE header after the DOS image header.\r
-      // Check if address overflow firstly.\r
       //\r
-      if ((MAX_ADDRESS - (UINTN)DosHdr->e_lfanew) > Pe32Data) {\r
-        Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)(Pe32Data + (UINTN)(DosHdr->e_lfanew));\r
+      Hdr.Pe32 = (EFI_IMAGE_NT_HEADERS32 *)(Pe32Data + (UINTN) ((DosHdr->e_lfanew) & 0x0ffff));\r
+      //\r
+      // Make sure PE header address does not overflow and is less than the initial address.\r
+      //\r
+      if (((UINTN)Hdr.Pe32 > Pe32Data) && ((UINTN)Hdr.Pe32 < (UINTN)mErrorMsgVersionAlert)) {\r
         if (Hdr.Pe32->Signature == EFI_IMAGE_NT_SIGNATURE) {\r
           //\r
           // It's PE image.\r
@@ -572,6 +574,7 @@ DebugAgentDataMsgPrint (
   @retval EFI_SUCCESS        Read the symbol in BreakSymbol.\r
   @retval EFI_CRC_ERROR      CRC check fail.\r
   @retval EFI_TIMEOUT        Timeout occurs when reading debug packet.\r
+  @retval EFI_DEVICE_ERROR   Receive the old or responsed packet.\r
 \r
 **/\r
 EFI_STATUS\r
@@ -581,10 +584,12 @@ ReadRemainingBreakPacket (
   )\r
 {\r
   UINT16                     Crc;\r
+  DEBUG_AGENT_MAILBOX        *Mailbox;\r
+\r
   //\r
   // Has received start symbol, try to read the rest part\r
   //\r
-  if (DebugPortReadBuffer (Handle, &DebugHeader->Command, sizeof (DEBUG_PACKET_HEADER) - 1, READ_PACKET_TIMEOUT) == 0) {\r
+  if (DebugPortReadBuffer (Handle, (UINT8 *)DebugHeader + OFFSET_OF (DEBUG_PACKET_HEADER, Command), sizeof (DEBUG_PACKET_HEADER) - OFFSET_OF (DEBUG_PACKET_HEADER, Command), READ_PACKET_TIMEOUT) == 0) {\r
     //\r
     // Timeout occur, exit\r
     //\r
@@ -599,9 +604,20 @@ ReadRemainingBreakPacket (
     DebugAgentDataMsgPrint (DEBUG_AGENT_VERBOSE, FALSE, (UINT8 *)DebugHeader, DebugHeader->Length);\r
     return EFI_CRC_ERROR;\r
   }\r
-\r
-  UpdateMailboxContent (GetMailboxPointer(), DEBUG_MAILBOX_HOST_SEQUENCE_NO_INDEX, DebugHeader->SequenceNo);\r
-  return EFI_SUCCESS;\r
+  Mailbox = GetMailboxPointer();\r
+  if (((DebugHeader->Command & DEBUG_COMMAND_RESPONSE) == 0) &&\r
+       (DebugHeader->SequenceNo == (UINT8) (Mailbox->HostSequenceNo + 1))) {\r
+    //\r
+    // Only updagte HostSequenceNo for new command packet \r
+    //\r
+    UpdateMailboxContent (Mailbox, DEBUG_MAILBOX_HOST_SEQUENCE_NO_INDEX, DebugHeader->SequenceNo);\r
+    return EFI_SUCCESS;\r
+  } else {\r
+    //\r
+    // If one old command or response packet received, skip it\r
+    //\r
+    return EFI_DEVICE_ERROR;\r
+  }\r
 }\r
 \r
 /**\r
@@ -1000,7 +1016,7 @@ ReceivePacket (
     //\r
     Received = DebugPortReadBuffer (\r
                  Handle,\r
-                 &DebugHeader->Command,\r
+                 (UINT8 *)DebugHeader + OFFSET_OF (DEBUG_PACKET_HEADER, Command),\r
                  OFFSET_OF (DEBUG_PACKET_HEADER, Length) + sizeof (DebugHeader->Length) - sizeof (DebugHeader->StartSymbol),\r
                  Timeout\r
                  );\r
@@ -2090,6 +2106,7 @@ InterruptProcess (
   UINT32                           IssuedViewPoint;\r
   DEBUG_AGENT_EXCEPTION_BUFFER     *ExceptionBuffer;\r
 \r
+  InputCharacter  = 0;\r
   ProcessorIndex  = 0;\r
   IssuedViewPoint = 0;\r
   BreakReceived   = FALSE;\r