Remove the complex buffer since the _LOCK_VARIABLE won't be allowed after leaving...

[mirror_edk2.git] / MdeModulePkg / Universal / Variable / RuntimeDxe / VariableSmmRuntimeDxe.c

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
index 865b9ad1a408a30bab9ee5b5f8852d5cad919567..e7b10149fb15fc791577dff78e521c87e3eaa2e6 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
@@ -186,6 +186,7 @@ VariableLockRequestToLock (
   )\r
 {\r
   EFI_STATUS                                Status;\r
+  UINTN                                     VariableNameSize;\r
   UINTN                                     PayloadSize;\r
   SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE    *VariableToLock;\r
 \r
@@ -193,13 +194,22 @@ VariableLockRequestToLock (
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
+  VariableNameSize = StrSize (VariableName);\r
+\r
+  //\r
+  // If VariableName exceeds SMM payload limit. Return failure\r
+  //\r
+  if (VariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   AcquireLockOnlyAtBootTime(&mVariableServicesLock);\r
 \r
   //\r
   // Init the communicate buffer. The buffer data size is:\r
   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.\r
   //\r
-  PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name) + StrSize (VariableName);\r
+  PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name) + VariableNameSize;\r
   Status = InitCommunicateBuffer ((VOID **) &VariableToLock, PayloadSize, SMM_VARIABLE_FUNCTION_LOCK_VARIABLE);\r
   if (EFI_ERROR (Status)) {\r
     goto Done;\r
@@ -207,7 +217,7 @@ VariableLockRequestToLock (
   ASSERT (VariableToLock != NULL);\r
 \r
   CopyGuid (&VariableToLock->Guid, VendorGuid);\r
-  VariableToLock->NameSize = StrSize (VariableName);\r
+  VariableToLock->NameSize = VariableNameSize;\r
   CopyMem (VariableToLock->Name, VariableName, VariableToLock->NameSize);\r
 \r
   //\r