MdeModulePkg DxeCore: Address boundary check for Type AllocateAddress

[mirror_edk2.git] / MdeModulePkg / Core / Dxe / Mem / Page.c

diff --git a/MdeModulePkg/Core/Dxe/Mem/Page.c b/MdeModulePkg/Core/Dxe/Mem/Page.c
index 9dbb85da7c871b61582499fb6ebac4689a99f13c..2f4ff8ecfdab6fe22ed2baa8b1060bd31a1c8830 100644 (file)
--- a/MdeModulePkg/Core/Dxe/Mem/Page.c
+++ b/MdeModulePkg/Core/Dxe/Mem/Page.c
@@ -1,7 +1,7 @@
 /** @file\r
   UEFI Memory page management functions.\r
 \r
-Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -725,7 +725,7 @@ CoreConvertPagesEx (
   ASSERT_LOCKED (&gMemoryLock);\r
   ASSERT ( (ChangingType == FALSE) || (ChangingAttributes == FALSE) );\r
 \r
-  if (NumberOfPages == 0 || ((Start & EFI_PAGE_MASK) != 0) || (Start > (Start + NumberOfBytes))) {\r
+  if (NumberOfPages == 0 || ((Start & EFI_PAGE_MASK) != 0) || (Start >= End)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
@@ -1201,6 +1201,8 @@ CoreInternalAllocatePages (
 {\r
   EFI_STATUS      Status;\r
   UINT64          Start;\r
+  UINT64          NumberOfBytes;\r
+  UINT64          End;\r
   UINT64          MaxAddress;\r
   UINTN           Alignment;\r
 \r
@@ -1246,6 +1248,30 @@ CoreInternalAllocatePages (
   //\r
   MaxAddress = MAX_ADDRESS;\r
 \r
+  //\r
+  // Check for Type AllocateAddress,\r
+  // if NumberOfPages is 0 or\r
+  // if (NumberOfPages << EFI_PAGE_SHIFT) is above MAX_ADDRESS or\r
+  // if (Start + NumberOfBytes) rolls over 0 or\r
+  // if Start is above MAX_ADDRESS or\r
+  // if End is above MAX_ADDRESS,\r
+  // return EFI_NOT_FOUND.\r
+  //\r
+  if (Type == AllocateAddress) {\r
+    if ((NumberOfPages == 0) ||\r
+        (NumberOfPages > RShiftU64 (MaxAddress, EFI_PAGE_SHIFT))) {\r
+      return EFI_NOT_FOUND;\r
+    }\r
+    NumberOfBytes = LShiftU64 (NumberOfPages, EFI_PAGE_SHIFT);\r
+    End = Start + NumberOfBytes - 1;\r
+\r
+    if ((Start >= End) ||\r
+        (Start > MaxAddress) || \r
+        (End > MaxAddress)) {\r
+      return EFI_NOT_FOUND;\r
+    }\r
+  }\r
+\r
   if (Type == AllocateMaxAddress) {\r
     MaxAddress = Start;\r
   }\r