MdeModulePkg/SecurityPkg Variable: Add boundary check for while (IsValidVariableHeade...

[mirror_edk2.git] / MdeModulePkg / Universal / Variable / Pei / Variable.c

diff --git a/MdeModulePkg/Universal/Variable/Pei/Variable.c b/MdeModulePkg/Universal/Variable/Pei/Variable.c
index df0304748c1a871bbbc81eb8b83b3d5123053dc6..4716cc5124a6837f9d650eb8646b533f763c48a3 100644 (file)
--- a/MdeModulePkg/Universal/Variable/Pei/Variable.c
+++ b/MdeModulePkg/Universal/Variable/Pei/Variable.c
@@ -3,7 +3,7 @@
   Implement ReadOnly Variable Services required by PEIM and install\r
   PEI ReadOnly Varaiable2 PPI. These services operates the non volatile storage space.\r
 \r
-Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -547,14 +547,25 @@ GetVariableHeader (
   EFI_HOB_GUID_TYPE     *GuidHob;\r
   UINTN                 PartialHeaderSize;\r
 \r
+  if (Variable == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
    //\r
    // First assume variable header pointed by Variable is consecutive.\r
    //\r
   *VariableHeader = Variable;\r
 \r
-  if ((Variable != NULL) && (StoreInfo->FtwLastWriteData != NULL)) {\r
+  if (StoreInfo->FtwLastWriteData != NULL) {\r
     TargetAddress = StoreInfo->FtwLastWriteData->TargetAddress;\r
     SpareAddress = StoreInfo->FtwLastWriteData->SpareAddress;\r
+    if (((UINTN) Variable > (UINTN) SpareAddress) &&\r
+        (((UINTN) Variable - (UINTN) SpareAddress + (UINTN) TargetAddress) >= (UINTN) GetEndPointer (StoreInfo->VariableStoreHeader))) {\r
+      //\r
+      // Reach the end of variable store.\r
+      //\r
+      return FALSE;\r
+    }\r
     if (((UINTN) Variable < (UINTN) TargetAddress) && (((UINTN) Variable + sizeof (VARIABLE_HEADER)) > (UINTN) TargetAddress)) {\r
       //\r
       // Variable header pointed by Variable is inconsecutive,\r
@@ -576,6 +587,13 @@ GetVariableHeader (
         CopyMem ((UINT8 *) *VariableHeader + PartialHeaderSize, (UINT8 *) (UINTN) SpareAddress, sizeof (VARIABLE_HEADER) - PartialHeaderSize);\r
       }\r
     }\r
+  } else {\r
+    if (Variable >= GetEndPointer (StoreInfo->VariableStoreHeader)) {\r
+      //\r
+      // Reach the end of variable store.\r
+      //\r
+      return FALSE;\r
+    }\r
   }\r
 \r
   return IsValidVariableHeader (*VariableHeader);\r