MdePkg DevicePathLib: Validate before touch input buffer.

[mirror_edk2.git] / MdePkg / Library / UefiDevicePathLibDevicePathProtocol / UefiDevicePathLib.c

diff --git a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
index b73bcce07c14a5f50075cb9f1ad337716293932a..2252d186cbf3215c2091254a5862800779cc20c4 100644 (file)
--- a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
+++ b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
@@ -2,7 +2,7 @@
   Library instance that implement UEFI Device Path Library class based on protocol\r
   gEfiDevicePathUtilitiesProtocolGuid.\r
 \r
-  Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r
@@ -103,17 +103,33 @@ IsDevicePathValid (
 \r
   ASSERT (DevicePath != NULL);\r
 \r
+  if (MaxSize == 0) {\r
+    MaxSize = MAX_UINTN;\r
+  }\r
+\r
+  //\r
+  // Validate the input size big enough to touch the first node.\r
+  //\r
+  if (MaxSize < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {\r
+    return FALSE;\r
+  }\r
+\r
   for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {\r
     NodeLength = DevicePathNodeLength (DevicePath);\r
     if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {\r
       return FALSE;\r
     }\r
 \r
-    if (MaxSize > 0) {\r
-      Size += NodeLength;\r
-      if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {\r
-        return FALSE;\r
-      }\r
+    if (NodeLength > MAX_UINTN - Size) {\r
+      return FALSE;\r
+    }\r
+    Size += NodeLength;\r
+\r
+    //\r
+    // Validate next node before touch it.\r
+    //\r
+    if (Size > MaxSize - END_DEVICE_PATH_LENGTH ) {\r
+      return FALSE;\r
     }\r
 \r
     if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {\r
@@ -195,12 +211,8 @@ DevicePathNodeLength (
   IN CONST VOID  *Node\r
   )\r
 {\r
-  UINTN Length;\r
-\r
   ASSERT (Node != NULL);\r
-  Length = ReadUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0]);\r
-  ASSERT (Length >= sizeof (EFI_DEVICE_PATH_PROTOCOL));\r
-  return Length;\r
+  return ReadUnaligned16 ((UINT16 *)&((EFI_DEVICE_PATH_PROTOCOL *)(Node))->Length[0]);\r
 }\r
 \r
 /**\r
@@ -567,8 +579,7 @@ GetNextDevicePathInstance (
   If there is not enough memory to allocate space for the new device path, then \r
   NULL is returned.  \r
   The memory is allocated from EFI boot services memory. It is the responsibility \r
-  of the caller to\r
-  free the memory allocated.\r
+  of the caller to free the memory allocated.\r
 \r
   @param  NodeType                   The device node type for the new device node.\r
   @param  NodeSubType                The device node sub-type for the new device node.\r