MdeModulePkg/DxeCore: Avoid accessing non-owned memory

[mirror_edk2.git] / MdeModulePkg / Core / Dxe / Hand / Handle.c

diff --git a/MdeModulePkg/Core/Dxe/Hand/Handle.c b/MdeModulePkg/Core/Dxe/Hand/Handle.c
index 59b89148c8f0c51d6adb2ba7c615ffe8f4bf98b5..9b2809dbe5c3d054403a2c2bcc5bb26b71b55c13 100644 (file)
--- a/MdeModulePkg/Core/Dxe/Hand/Handle.c
+++ b/MdeModulePkg/Core/Dxe/Hand/Handle.c
@@ -72,15 +72,20 @@ CoreValidateHandle (
   )\r
 {\r
   IHANDLE             *Handle;\r
+  LIST_ENTRY          *Link;\r
 \r
-  Handle = (IHANDLE *)UserHandle;\r
-  if (Handle == NULL) {\r
+  if (UserHandle == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
-  if (Handle->Signature != EFI_HANDLE_SIGNATURE) {\r
-    return EFI_INVALID_PARAMETER;\r
+\r
+  for (Link = gHandleList.BackLink; Link != &gHandleList; Link = Link->BackLink) {\r
+    Handle = CR (Link, IHANDLE, AllHandles, EFI_HANDLE_SIGNATURE);\r
+    if (Handle == (IHANDLE *) UserHandle) {\r
+      return EFI_SUCCESS;\r
+    }\r
   }\r
-  return EFI_SUCCESS;\r
+\r
+  return EFI_INVALID_PARAMETER;\r
 }\r
 \r
 \r
@@ -643,19 +648,16 @@ CoreDisconnectControllersUsingProtocolInterface (
   //\r
   do {\r
     ItemFound = FALSE;\r
-    for ( Link = Prot->OpenList.ForwardLink;\r
-          (Link != &Prot->OpenList) && !ItemFound;\r
-          Link = Link->ForwardLink ) {\r
+    for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList; Link = Link->ForwardLink) {\r
       OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);\r
       if ((OpenData->Attributes & EFI_OPEN_PROTOCOL_BY_DRIVER) != 0) {\r
-        ItemFound = TRUE;\r
         CoreReleaseProtocolLock ();\r
         Status = CoreDisconnectController (UserHandle, OpenData->AgentHandle, NULL);\r
         CoreAcquireProtocolLock ();\r
-        if (EFI_ERROR (Status)) {\r
-           ItemFound = FALSE;\r
-           break;\r
+        if (!EFI_ERROR (Status)) {\r
+          ItemFound = TRUE;\r
         }\r
+        break;\r
       }\r
     }\r
   } while (ItemFound);\r
@@ -664,21 +666,17 @@ CoreDisconnectControllersUsingProtocolInterface (
     //\r
     // Attempt to remove BY_HANDLE_PROTOOCL and GET_PROTOCOL and TEST_PROTOCOL Open List items\r
     //\r
-    do {\r
-      ItemFound = FALSE;\r
-      for ( Link = Prot->OpenList.ForwardLink;\r
-            (Link != &Prot->OpenList) && !ItemFound;\r
-            Link = Link->ForwardLink ) {\r
-        OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);\r
-        if ((OpenData->Attributes &\r
-            (EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL | EFI_OPEN_PROTOCOL_GET_PROTOCOL | EFI_OPEN_PROTOCOL_TEST_PROTOCOL)) != 0) {\r
-          ItemFound = TRUE;\r
-          RemoveEntryList (&OpenData->Link);\r
-          Prot->OpenListCount--;\r
-          CoreFreePool (OpenData);\r
-        }\r
+    for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList;) {\r
+      OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);\r
+      if ((OpenData->Attributes &\r
+          (EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL | EFI_OPEN_PROTOCOL_GET_PROTOCOL | EFI_OPEN_PROTOCOL_TEST_PROTOCOL)) != 0) {\r
+        Link = RemoveEntryList (&OpenData->Link);\r
+        Prot->OpenListCount--;\r
+        CoreFreePool (OpenData);\r
+      } else {\r
+        Link = Link->ForwardLink;\r
       }\r
-    } while (ItemFound);\r
+    }\r
   }\r
 \r
   //\r
@@ -1132,7 +1130,7 @@ CoreOpenProtocol (
     if (ByDriver) {\r
       do {\r
         Disconnect = FALSE;\r
-        for ( Link = Prot->OpenList.ForwardLink; (Link != &Prot->OpenList) && (!Disconnect); Link = Link->ForwardLink) {\r
+        for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList; Link = Link->ForwardLink) {\r
           OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);\r
           if ((OpenData->Attributes & EFI_OPEN_PROTOCOL_BY_DRIVER) != 0) {\r
             Disconnect = TRUE;\r
@@ -1142,6 +1140,8 @@ CoreOpenProtocol (
             if (EFI_ERROR (Status)) {\r
               Status = EFI_ACCESS_DENIED;\r
               goto Done;\r
+            } else {\r
+              break;\r
             }\r
           }\r
         }\r