SecurityPkg/SecureBootConfigDxe: Fix invalid NV data issue.

[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / SecureBootConfigDxe / SecureBootConfigImpl.c

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index d035763106852ef8b4dde3e363a272dc81a6f9f6..6123b5669779a87927076b11671eca29d6fc433b 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -2,6 +2,7 @@
   HII Config Access protocol implementation of SecureBoot configuration module.\r
 \r
 Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>\r
+(C) Copyright 2018 Hewlett Packard Enterprise Development LP<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -3145,6 +3146,9 @@ DeleteSignatureEx (
   if (DelType == Delete_Signature_List_All) {\r
     VariableDataSize = 0;\r
   } else {\r
+    //\r
+    //  Traverse to target EFI_SIGNATURE_LIST but others will be skipped.\r
+    //\r
     while ((RemainingSize > 0) && (RemainingSize >= ListWalker->SignatureListSize) && ListIndex < PrivateData->ListIndex) {\r
       CopyMem ((UINT8 *)NewVariableData + Offset, ListWalker, ListWalker->SignatureListSize);\r
       Offset += ListWalker->SignatureListSize;\r
@@ -3154,15 +3158,17 @@ DeleteSignatureEx (
       ListIndex++;\r
     }\r
 \r
-    if (CheckedCount == SIGNATURE_DATA_COUNTS (ListWalker) || DelType == Delete_Signature_List_One) {\r
-      RemainingSize -= ListWalker->SignatureListSize;\r
-      ListWalker = (EFI_SIGNATURE_LIST *)((UINT8 *)ListWalker + ListWalker->SignatureListSize);\r
-    } else {\r
+    //\r
+    //  Handle the target EFI_SIGNATURE_LIST.\r
+    //  If CheckedCount == SIGNATURE_DATA_COUNTS (ListWalker) or DelType == Delete_Signature_List_One\r
+    //  it means delete the whole EFI_SIGNATURE_LIST, So we just skip this EFI_SIGNATURE_LIST.\r
+    //\r
+    if (CheckedCount < SIGNATURE_DATA_COUNTS (ListWalker) && DelType == Delete_Signature_Data) {\r
       NewCertList = (EFI_SIGNATURE_LIST *)(NewVariableData + Offset);\r
       //\r
       // Copy header.\r
       //\r
-      CopyMem ((UINT8 *)NewVariableData, ListWalker, sizeof (EFI_SIGNATURE_LIST) + ListWalker->SignatureHeaderSize);\r
+      CopyMem ((UINT8 *)NewVariableData + Offset, ListWalker, sizeof (EFI_SIGNATURE_LIST) + ListWalker->SignatureHeaderSize);\r
       Offset += sizeof (EFI_SIGNATURE_LIST) + ListWalker->SignatureHeaderSize;\r
 \r
       DataWalker = (EFI_SIGNATURE_DATA *)((UINT8 *)ListWalker + sizeof(EFI_SIGNATURE_LIST) + ListWalker->SignatureHeaderSize);\r
@@ -3181,10 +3187,11 @@ DeleteSignatureEx (
         }\r
         DataWalker = (EFI_SIGNATURE_DATA *)((UINT8 *)DataWalker + ListWalker->SignatureSize);\r
       }\r
-\r
-      RemainingSize -= ListWalker->SignatureListSize;\r
     }\r
 \r
+    RemainingSize -= ListWalker->SignatureListSize;\r
+    ListWalker = (EFI_SIGNATURE_LIST *)((UINT8 *)ListWalker + ListWalker->SignatureListSize);\r
+\r
     //\r
     // Copy remaining data, maybe 0.\r
     //\r
@@ -4313,6 +4320,7 @@ SecureBootCallback (
   UINTN                           NameLength;\r
   UINT16                          *FilePostFix;\r
   SECUREBOOT_CONFIG_PRIVATE_DATA  *PrivateData;\r
+  BOOLEAN                         GetBrowserDataResult;\r
 \r
   Status           = EFI_SUCCESS;\r
   SecureBootEnable = NULL;\r
@@ -4337,7 +4345,7 @@ SecureBootCallback (
     return EFI_OUT_OF_RESOURCES;\r
   }\r
 \r
-  HiiGetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8 *) IfrNvData);\r
+  GetBrowserDataResult = HiiGetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8 *) IfrNvData);\r
 \r
   if (Action == EFI_BROWSER_ACTION_FORM_OPEN) {\r
     if (QuestionId == KEY_SECURE_BOOT_MODE) {\r
@@ -4883,7 +4891,7 @@ SecureBootCallback (
 \r
 EXIT:\r
 \r
-  if (!EFI_ERROR (Status)) {\r
+  if (!EFI_ERROR (Status) && GetBrowserDataResult) {\r
     BufferSize = sizeof (SECUREBOOT_CONFIGURATION);\r
     HiiSetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8*) IfrNvData, NULL);\r
   }\r