1. Fix TOCTOU issue in VariableSmm, FtwSmm, FpdtSmm, SmmCorePerformance SMM handler...

[mirror_edk2.git] / MdeModulePkg / Universal / Acpi / FirmwarePerformanceDataTableSmm / FirmwarePerformanceSmm.c

diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c
index ebf81ca6f72ce1106e1db10b5eebdd6a0efbf9ce..f3472e26f3db70e3afadb5c7cb15395d3dff7011 100644 (file)
--- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c
+++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c
@@ -266,6 +266,8 @@ FpdtSmiHandler (
 {\r
   EFI_STATUS                   Status;\r
   SMM_BOOT_RECORD_COMMUNICATE  *SmmCommData;\r
+  UINTN                        BootRecordSize;\r
+  VOID                         *BootRecordData;\r
 \r
   //\r
   // If input is invalid, stop processing this SMI\r
@@ -279,7 +281,7 @@ FpdtSmiHandler (
   }\r
   \r
   if (!InternalIsAddressValid ((UINTN)CommBuffer, *CommBufferSize)) {\r
-    DEBUG ((EFI_D_ERROR, "SMM communication data buffer in SMRAM or overflow!\n"));\r
+    DEBUG ((EFI_D_ERROR, "FpdtSmiHandler: SMM communication data buffer in SMRAM or overflow!\n"));\r
     return EFI_SUCCESS;\r
   }\r
 \r
@@ -293,7 +295,9 @@ FpdtSmiHandler (
        break;\r
 \r
     case SMM_FPDT_FUNCTION_GET_BOOT_RECORD_DATA :\r
-       if (SmmCommData->BootRecordData == NULL || SmmCommData->BootRecordSize < mBootRecordSize) {\r
+       BootRecordData = SmmCommData->BootRecordData;\r
+       BootRecordSize = SmmCommData->BootRecordSize;\r
+       if (BootRecordData == NULL || BootRecordSize < mBootRecordSize) {\r
          Status = EFI_INVALID_PARAMETER;\r
          break;\r
        } \r
@@ -302,14 +306,14 @@ FpdtSmiHandler (
        // Sanity check\r
        //\r
        SmmCommData->BootRecordSize = mBootRecordSize;\r
-       if (!InternalIsAddressValid ((UINTN)SmmCommData->BootRecordData, mBootRecordSize)) {\r
-         DEBUG ((EFI_D_ERROR, "SMM Data buffer in SMRAM or overflow!\n"));\r
+       if (!InternalIsAddressValid ((UINTN)BootRecordData, mBootRecordSize)) {\r
+         DEBUG ((EFI_D_ERROR, "FpdtSmiHandler: SMM Data buffer in SMRAM or overflow!\n"));\r
          Status = EFI_ACCESS_DENIED;\r
          break;\r
        }\r
 \r
        CopyMem (\r
-         (UINT8*)SmmCommData->BootRecordData, \r
+         (UINT8*)BootRecordData, \r
          mBootRecordBuffer, \r
          mBootRecordSize\r
          );\r