MdeModulePkg/RamDiskDxe: Restrict on RAM disk size (CVE-2018-12180)

[mirror_edk2.git] / MdeModulePkg / Universal / Disk / RamDiskDxe / RamDiskBlockIo.c

diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
index 4f74b5ef1531aa80cead18f867e1744dd98ab176..8926ad7d2f5a347465255e88b6b6cc10761b3587 100644 (file)
--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
+++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
@@ -1,7 +1,7 @@
 /** @file\r
   Produce EFI_BLOCK_IO_PROTOCOL on a RAM disk device.\r
 \r
-  Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r
@@ -54,6 +54,7 @@ RamDiskInitBlockIo (
   EFI_BLOCK_IO_PROTOCOL           *BlockIo;\r
   EFI_BLOCK_IO2_PROTOCOL          *BlockIo2;\r
   EFI_BLOCK_IO_MEDIA              *Media;\r
+  UINT32                          Remainder;\r
 \r
   BlockIo  = &PrivateData->BlockIo;\r
   BlockIo2 = &PrivateData->BlockIo2;\r
@@ -69,11 +70,18 @@ RamDiskInitBlockIo (
   Media->LogicalPartition = FALSE;\r
   Media->ReadOnly         = FALSE;\r
   Media->WriteCaching     = FALSE;\r
-  Media->BlockSize        = RAM_DISK_BLOCK_SIZE;\r
-  Media->LastBlock        = DivU64x32 (\r
-                              PrivateData->Size + RAM_DISK_BLOCK_SIZE - 1,\r
-                              RAM_DISK_BLOCK_SIZE\r
-                              ) - 1;\r
+\r
+  for (Media->BlockSize = RAM_DISK_DEFAULT_BLOCK_SIZE;\r
+       Media->BlockSize >= 1;\r
+       Media->BlockSize = Media->BlockSize >> 1) {\r
+    Media->LastBlock = DivU64x32Remainder (PrivateData->Size, Media->BlockSize, &Remainder) - 1;\r
+    if (Remainder == 0) {\r
+      break;\r
+    }\r
+  }\r
+  ASSERT (Media->BlockSize != 0);\r
+\r
+  return;\r
 }\r
 \r
 \r