NetworkPkg/SnpDxe: Prevent invalid PCI BAR access

[mirror_edk2.git] / NetworkPkg / SnpDxe / Callback.c

diff --git a/NetworkPkg/SnpDxe/Callback.c b/NetworkPkg/SnpDxe/Callback.c
index 0c0b81fdca8ee5d9bdf0183f67d217e301ca45c5..99b7fd3ef8357cb547f81b520bc40ac8ad4996ce 100644 (file)
--- a/NetworkPkg/SnpDxe/Callback.c
+++ b/NetworkPkg/SnpDxe/Callback.c
@@ -4,6 +4,7 @@
   stores the interface context for the NIC that snp is trying to talk.\r
 \r
 Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) Microsoft Corporation.<BR>\r
 SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
 **/\r
@@ -115,47 +116,59 @@ SnpUndi32CallbackMemio (
 \r
   switch (ReadOrWrite) {\r
   case PXE_IO_READ:\r
-    Snp->PciIo->Io.Read (\r
-                     Snp->PciIo,\r
-                     Width,\r
-                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address\r
-                     MemOrPortAddr,\r
-                     1,                    // count\r
-                     (VOID *) (UINTN) BufferPtr\r
-                     );\r
+    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);\r
+    if (Snp->IoBarIndex < PCI_MAX_BAR) {\r
+      Snp->PciIo->Io.Read (\r
+                       Snp->PciIo,\r
+                       Width,\r
+                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address\r
+                       MemOrPortAddr,\r
+                       1,                    // count\r
+                       (VOID *) (UINTN) BufferPtr\r
+                       );\r
+    }\r
     break;\r
 \r
   case PXE_IO_WRITE:\r
-    Snp->PciIo->Io.Write (\r
-                     Snp->PciIo,\r
-                     Width,\r
-                     Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address\r
-                     MemOrPortAddr,\r
-                     1,                    // count\r
-                     (VOID *) (UINTN) BufferPtr\r
-                     );\r
+    ASSERT (Snp->IoBarIndex < PCI_MAX_BAR);\r
+    if (Snp->IoBarIndex < PCI_MAX_BAR) {\r
+      Snp->PciIo->Io.Write (\r
+                       Snp->PciIo,\r
+                       Width,\r
+                       Snp->IoBarIndex,      // BAR 1 (for 32bit regs), IO base address\r
+                       MemOrPortAddr,\r
+                       1,                    // count\r
+                       (VOID *) (UINTN) BufferPtr\r
+                       );\r
+    }\r
     break;\r
 \r
   case PXE_MEM_READ:\r
-    Snp->PciIo->Mem.Read (\r
-                      Snp->PciIo,\r
-                      Width,\r
-                      Snp->MemoryBarIndex,  // BAR 0, Memory base address\r
-                      MemOrPortAddr,\r
-                      1,                    // count\r
-                      (VOID *) (UINTN) BufferPtr\r
-                      );\r
+    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);\r
+    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {\r
+      Snp->PciIo->Mem.Read (\r
+                        Snp->PciIo,\r
+                        Width,\r
+                        Snp->MemoryBarIndex,  // BAR 0, Memory base address\r
+                        MemOrPortAddr,\r
+                        1,                    // count\r
+                        (VOID *) (UINTN) BufferPtr\r
+                        );\r
+    }\r
     break;\r
 \r
   case PXE_MEM_WRITE:\r
-    Snp->PciIo->Mem.Write (\r
-                      Snp->PciIo,\r
-                      Width,\r
-                      Snp->MemoryBarIndex,  // BAR 0, Memory base address\r
-                      MemOrPortAddr,\r
-                      1,                    // count\r
-                      (VOID *) (UINTN) BufferPtr\r
-                      );\r
+    ASSERT (Snp->MemoryBarIndex < PCI_MAX_BAR);\r
+    if (Snp->MemoryBarIndex < PCI_MAX_BAR) {\r
+      Snp->PciIo->Mem.Write (\r
+                        Snp->PciIo,\r
+                        Width,\r
+                        Snp->MemoryBarIndex,  // BAR 0, Memory base address\r
+                        MemOrPortAddr,\r
+                        1,                    // count\r
+                        (VOID *) (UINTN) BufferPtr\r
+                        );\r
+    }\r
     break;\r
   }\r
 \r