From: Gary Ching-Pang Lin <glin@suse.com>
Date: Fri, 21 Sep 2012 08:44:56 +0000 (+0800)
Subject: Make sure the variables are not broken
X-Git-Tag: proxmox/15.7-1+pmx1~169^2^2~46
X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=6919a3f7c77097c857f83fb980e6fd479348b1ea;p=efi-boot-shim.git

Make sure the variables are not broken
---

diff --git a/MokManager.c b/MokManager.c
index 9025f6f..97501f6 100644
--- a/MokManager.c
+++ b/MokManager.c
@@ -101,6 +101,9 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
 	int i;
 	void *ptr;
 
+	if (DataSize < sizeof(UINT32))
+		return NULL;
+
 	list = AllocatePool(sizeof(MokListNode) * num);
 
 	if (!list) {
@@ -478,7 +481,7 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
 	efi_status = get_variable(L"MokNew", shim_lock_guid, &attributes,
 				  &MokNewSize, &MokNew);
 
-	if (efi_status != EFI_SUCCESS) {
+	if (efi_status != EFI_SUCCESS || MokNewSize < sizeof(UINT32)) {
 		goto error;
 	}
 
diff --git a/shim.c b/shim.c
index 73b2feb..95c3e54 100644
--- a/shim.c
+++ b/shim.c
@@ -107,6 +107,9 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
 	int i, remain = DataSize;
 	void *ptr;
 
+	if (DataSize < sizeof(UINT32))
+		return NULL;
+
 	list = AllocatePool(sizeof(MokListNode) * num);
 
 	if (!list) {
@@ -601,7 +604,7 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
 	status = get_variable(L"MokList", shim_lock_guid, &attributes,
 			      &MokListDataSize, &MokListData);
 
-	if (status != EFI_SUCCESS) {
+	if (status != EFI_SUCCESS || MokListDataSize < sizeof(UINT32)) {
 		status = EFI_ACCESS_DENIED;
 		Print(L"Invalid signature\n");
 		goto done;