MdePkg UefiDevicePathLib: Validate before touch input buffer.

[mirror_edk2.git] / MdePkg / Library / UefiDevicePathLib / DevicePathUtilities.c

diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
index 024dcc271d9705761a03413a52f9a3d63d4fb62f..bb4a56398e3c92c6b249d765d90b3144f72f492c 100644 (file)
--- a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
+++ b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
@@ -61,17 +61,33 @@ IsDevicePathValid (
 \r
   ASSERT (DevicePath != NULL);\r
 \r
 \r
   ASSERT (DevicePath != NULL);\r
 \r

+  if (MaxSize == 0) {\r
+    MaxSize = MAX_UINTN;\r
+  }\r
+\r
+  //\r
+  // Validate the input size big enough to touch the first node.\r
+  //\r
+  if (MaxSize < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {\r
+    return FALSE;\r
+  }\r
+\r

   for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {\r
     NodeLength = DevicePathNodeLength (DevicePath);\r
     if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {\r
       return FALSE;\r
     }\r
 \r
   for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {\r
     NodeLength = DevicePathNodeLength (DevicePath);\r
     if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {\r
       return FALSE;\r
     }\r
 \r

-    if (MaxSize > 0) {\r
-      Size += NodeLength;\r
-      if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {\r
-        return FALSE;\r
-      }\r
+    if (NodeLength > MAX_UINTN - Size) {\r
+      return FALSE;\r
+    }\r
+    Size += NodeLength;\r
+\r
+    //\r
+    // Validate next node before touch it.\r
+    //\r
+    if (Size > MaxSize - END_DEVICE_PATH_LENGTH ) {\r
+      return FALSE;\r

     }\r
 \r
     if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {\r
     }\r
 \r
     if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {\r