Make sure CapsuleImage size is equal or less than DataBlock Size. And when copy the...

[mirror_edk2.git] / MdeModulePkg / Universal / CapsulePei / Common / CapsuleCoalesce.c

diff --git a/MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c b/MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c
index a95b4722c542733d1bceedb9e178f24c703ca75f..ec6b86f09f0c939e820d0bff3093738b1fd79bf8 100644 (file)
--- a/MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c
+++ b/MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c
@@ -300,13 +300,14 @@ ValidateCapsuleIntegrity (
         }\r
         CapsuleCount ++;\r
         CapsuleSize = CapsuleHeader->CapsuleImageSize;\r
+      }\r
+\r
+      if (CapsuleSize >= Ptr->Length) {\r
+        CapsuleSize = CapsuleSize - Ptr->Length;\r
       } else {\r
-        if (CapsuleSize >= Ptr->Length) {\r
-          CapsuleSize = CapsuleSize - Ptr->Length;\r
-        } else {\r
-          CapsuleSize = 0;\r
-        }\r
+        CapsuleSize = 0;\r
       }\r
+\r
       //\r
       // Move to next BLOCK descriptor\r
       //\r
@@ -314,9 +315,9 @@ ValidateCapsuleIntegrity (
     }\r
   }\r
 \r
-  if (CapsuleCount == 0) {\r
+  if ((CapsuleCount == 0) || (CapsuleSize != 0)) {\r
     //\r
-    // No any capsule is found in BlockList.\r
+    // No any capsule is found in BlockList or capsule data is corrupted.\r
     //\r
     return NULL;\r
   }\r
@@ -1017,58 +1018,37 @@ CapsuleDataCoalesce (
           //\r
           IsCorrupted  = FALSE;\r
           CapsuleImageSize += SizeLeft;\r
-          CopyMem ((VOID *) DestPtr, (VOID *) (UINTN) CurrentBlockDesc->Union.DataBlock, (UINTN) CurrentBlockDesc->Length);\r
-          DEBUG ((EFI_D_INFO, "Capsule coalesce block no.0x%8X from 0x%8lX to 0x%8lX with size 0x%8X\n",CapsuleTimes,\r
-                 (UINTN)CurrentBlockDesc->Union.DataBlock, (UINTN)DestPtr, (UINTN)CurrentBlockDesc->Length));\r
           //\r
           // Cache the begin offset of this capsule\r
           //\r
           CapsuleOffset[CapsuleIndex++] = (UINT32) (UINTN) DestPtr - (UINT32)(UINTN)NewCapsuleBase - (UINT32)sizeof(EFI_CAPSULE_PEIM_PRIVATE_DATA);\r
+        }\r
+      }\r
+\r
+      if (CurrentBlockDesc->Length < SizeLeft) {\r
+        if (!IsCorrupted) {\r
+          CopyMem ((VOID *) DestPtr, (VOID *) (UINTN) (CurrentBlockDesc->Union.DataBlock), (UINTN)CurrentBlockDesc->Length);\r
+          DEBUG ((EFI_D_INFO, "Capsule coalesce block no.0x%8X from 0x%8lX to 0x%8lX with size 0x%8X\n",CapsuleTimes,\r
+                 (UINTN)CurrentBlockDesc->Union.DataBlock, (UINTN)DestPtr, (UINTN)CurrentBlockDesc->Length));\r
           DestPtr += CurrentBlockDesc->Length;\r
         }\r
+        SizeLeft -= CurrentBlockDesc->Length;\r
+      } else {\r
         //\r
-        // If the current block length is greater than or equal to SizeLeft, this is the \r
-        // start of the next capsule\r
+        //Here is the end of the current capsule image.\r
         //\r
-        if (CurrentBlockDesc->Length < SizeLeft) {\r
-          SizeLeft -= CurrentBlockDesc->Length;\r
-        } else {\r
-          //\r
-          // Start the next cycle\r
-          //\r
-          SizeLeft         = 0;\r
-          IsCorrupted      = TRUE;\r
-          CapsuleBeginFlag = TRUE;          \r
+        if (!IsCorrupted) {\r
+          CopyMem ((VOID *) DestPtr, (VOID *)(UINTN)(CurrentBlockDesc->Union.DataBlock), (UINTN) SizeLeft);\r
+          DEBUG ((EFI_D_INFO, "Capsule coalesce block no.0x%8X from 0x%8lX to 0x%8lX with size 0x%8X\n",CapsuleTimes,\r
+                 (UINTN)CurrentBlockDesc->Union.DataBlock, (UINTN)DestPtr, (UINTN) SizeLeft));\r
+          DestPtr += SizeLeft;\r
         }\r
-      } else {\r
         //\r
-        //Go on relocating the current capule image.\r
+        // Start the next cycle\r
         //\r
-        if (CurrentBlockDesc->Length < SizeLeft) {\r
-          if (!IsCorrupted) {\r
-            CopyMem ((VOID *) DestPtr, (VOID *) (UINTN) (CurrentBlockDesc->Union.DataBlock), (UINTN)CurrentBlockDesc->Length);\r
-            DEBUG ((EFI_D_INFO, "Capsule coalesce block no.0x%8X from 0x%8lX to 0x%8lX with size 0x%8X\n",CapsuleTimes,\r
-                   (UINTN)CurrentBlockDesc->Union.DataBlock, (UINTN)DestPtr, (UINTN)CurrentBlockDesc->Length));\r
-            DestPtr += CurrentBlockDesc->Length;\r
-          }\r
-          SizeLeft -= CurrentBlockDesc->Length;\r
-        } else {\r
-          //\r
-          //Here is the end of the current capsule image.\r
-          //\r
-          if (!IsCorrupted) {\r
-            CopyMem ((VOID *) DestPtr, (VOID *)(UINTN)(CurrentBlockDesc->Union.DataBlock), (UINTN)CurrentBlockDesc->Length);\r
-            DEBUG ((EFI_D_INFO, "Capsule coalesce block no.0x%8X from 0x%8lX to 0x%8lX with size 0x%8X\n",CapsuleTimes,\r
-                   (UINTN)CurrentBlockDesc->Union.DataBlock, (UINTN)DestPtr, (UINTN)CurrentBlockDesc->Length));\r
-            DestPtr += CurrentBlockDesc->Length;\r
-          }\r
-          //\r
-          // Start the next cycle\r
-          //\r
-          SizeLeft = 0;\r
-          IsCorrupted = TRUE;\r
-          CapsuleBeginFlag = TRUE; \r
-        }\r
+        SizeLeft = 0;\r
+        IsCorrupted = TRUE;\r
+        CapsuleBeginFlag = TRUE; \r
       }\r
     } else {\r
       //\r