Fix potential overflow for SetVariable interface

[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / EsalVariableDxeSal / Variable.c

diff --git a/SecurityPkg/VariableAuthenticated/EsalVariableDxeSal/Variable.c b/SecurityPkg/VariableAuthenticated/EsalVariableDxeSal/Variable.c
index d0269c9da744d9e8112c99d2f1ee131592bdbc3b..e098c81df31f80f49e549b04cb68ad0a9cbe8407 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/EsalVariableDxeSal/Variable.c
+++ b/SecurityPkg/VariableAuthenticated/EsalVariableDxeSal/Variable.c
@@ -1,7 +1,7 @@
 /** @file\r
   The implementation of Extended SAL variable services.\r
 \r
-Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 which accompanies this distribution.  The full text of the license may be found at \r
@@ -2591,6 +2591,14 @@ EsalSetVariable (
     PayloadSize = DataSize; \r
   }\r
 \r
+  \r
+  if ((UINTN)(~0) - PayloadSize < StrSize(VariableName)){\r
+    //\r
+    // Prevent whole variable size overflow \r
+    // \r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   VariableGlobal = &Global->VariableGlobal[VirtualMode];\r
   Instance = Global->FvbInstance;\r
 \r
@@ -2599,8 +2607,7 @@ EsalSetVariable (
     // For variable for hardware error record, the size of the VariableName, including the Unicode Null\r
     // in bytes plus the DataSize is limited to maximum size of PcdGet32(PcdMaxHardwareErrorVariableSize) bytes.\r
     //\r
-    if ((PayloadSize > PcdGet32(PcdMaxHardwareErrorVariableSize)) ||                                                       \r
-        (sizeof (VARIABLE_HEADER) + StrSize (VariableName) + PayloadSize > PcdGet32(PcdMaxHardwareErrorVariableSize))) {\r
+    if (StrSize (VariableName) + PayloadSize > PcdGet32(PcdMaxHardwareErrorVariableSize) - sizeof (VARIABLE_HEADER)) {\r
       return EFI_INVALID_PARAMETER;\r
     }\r
     //\r
@@ -2616,8 +2623,7 @@ EsalSetVariable (
     // For variable not for hardware error record, the size of the VariableName, including the\r
     // Unicode Null in bytes plus the DataSize is limited to maximum size of PcdGet32(PcdMaxVariableSize) bytes.\r
     //\r
-    if ((PayloadSize > PcdGet32(PcdMaxVariableSize)) ||\r
-        (sizeof (VARIABLE_HEADER) + StrSize (VariableName) + PayloadSize > PcdGet32(PcdMaxVariableSize))) {\r
+    if (StrSize (VariableName) + PayloadSize > PcdGet32(PcdMaxVariableSize) - sizeof (VARIABLE_HEADER)) {\r
       return EFI_INVALID_PARAMETER;\r
     }  \r
   }  \r