MdePkg UefiDevicePathLib: Validate buffer length before use buffer.

In IsDevicePathValid API, code should validate the device path
buffer not exceed the input MaxSize before reference the path
info.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>

diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
index 7f21a60380ac5fb800015c69f0f73b34c15c8b6b..82419a4e1b2ae618aa061b5462e08a8e0b6d2030 100644 (file)
--- a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
+++ b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
@@ -8,7 +8,7 @@
   environment varibles. Multi-instance device paths should never be placed\r
   on a Handle.\r
 \r
-  Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials                          \r
   are licensed and made available under the terms and conditions of the BSD License         \r
   which accompanies this distribution.  The full text of the license may be found at        \r
@@ -61,25 +61,35 @@ IsDevicePathValid (
 \r
   ASSERT (DevicePath != NULL);\r
 \r
-  for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {\r
+  if (MaxSize == 0){\r
+    MaxSize = MAX_UINTN;\r
+  }\r
+\r
+  Size = 0;\r
+  Count = 0;\r
+\r
+  while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) &&\r
+        (MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) &&\r
+        !IsDevicePathEnd (DevicePath)) {\r
     NodeLength = DevicePathNodeLength (DevicePath);\r
     if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {\r
       return FALSE;\r
     }\r
 \r
-    if (MaxSize > 0) {\r
-      Size += NodeLength;\r
-      if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {\r
-        return FALSE;\r
-      }\r
+    if (NodeLength > MAX_UINTN - Size) {\r
+      return FALSE;\r
     }\r
 \r
+    Size += NodeLength;\r
+\r
     if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {\r
       Count++;\r
       if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) {\r
         return FALSE;\r
       }\r
     }\r
+\r
+    DevicePath = NextDevicePathNode (DevicePath);\r
   }\r
 \r
   //\r
@@ -88,6 +98,7 @@ IsDevicePathValid (
   return (BOOLEAN) (DevicePathNodeLength (DevicePath) == END_DEVICE_PATH_LENGTH);\r
 }\r
 \r
+\r
 /**\r
   Returns the Type field of a device path node.\r
 \r