MdePkg UefiDevicePathLib: Validate before touch input buffer.

[mirror_edk2.git] / MdePkg / Library / UefiDevicePathLib / DevicePathUtilities.c

diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
index b48bf02ae8836128bac4b6c77703bcb6091ca9ae..bb4a56398e3c92c6b249d765d90b3144f72f492c 100644 (file)
--- a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
+++ b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
@@ -8,7 +8,7 @@
   environment varibles. Multi-instance device paths should never be placed\r
   on a Handle.\r
 \r
-  Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials                          \r
   are licensed and made available under the terms and conditions of the BSD License         \r
   which accompanies this distribution.  The full text of the license may be found at        \r
@@ -61,17 +61,33 @@ IsDevicePathValid (
 \r
   ASSERT (DevicePath != NULL);\r
 \r
+  if (MaxSize == 0) {\r
+    MaxSize = MAX_UINTN;\r
+  }\r
+\r
+  //\r
+  // Validate the input size big enough to touch the first node.\r
+  //\r
+  if (MaxSize < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {\r
+    return FALSE;\r
+  }\r
+\r
   for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {\r
     NodeLength = DevicePathNodeLength (DevicePath);\r
     if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {\r
       return FALSE;\r
     }\r
 \r
-    if (MaxSize > 0) {\r
-      Size += NodeLength;\r
-      if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {\r
-        return FALSE;\r
-      }\r
+    if (NodeLength > MAX_UINTN - Size) {\r
+      return FALSE;\r
+    }\r
+    Size += NodeLength;\r
+\r
+    //\r
+    // Validate next node before touch it.\r
+    //\r
+    if (Size > MaxSize - END_DEVICE_PATH_LENGTH ) {\r
+      return FALSE;\r
     }\r
 \r
     if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {\r
@@ -88,6 +104,7 @@ IsDevicePathValid (
   return (BOOLEAN) (DevicePathNodeLength (DevicePath) == END_DEVICE_PATH_LENGTH);\r
 }\r
 \r
+\r
 /**\r
   Returns the Type field of a device path node.\r
 \r
@@ -153,12 +170,8 @@ DevicePathNodeLength (
   IN CONST VOID  *Node\r
   )\r
 {\r
-  UINTN Length;\r
-\r
   ASSERT (Node != NULL);\r
-  Length = ReadUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0]);\r
-  ASSERT (Length >= sizeof (EFI_DEVICE_PATH_PROTOCOL));\r
-  return Length;\r
+  return ReadUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0]);\r
 }\r
 \r
 /**\r