UefiCpuPkg/Microcode.c: Add verification before calculate CheckSum32
authorChen A Chen <chen.a.chen@intel.com>
Tue, 5 Mar 2019 00:21:18 +0000 (08:21 +0800)
committerRay Ni <ray.ni@intel.com>
Wed, 6 Mar 2019 05:48:36 +0000 (13:48 +0800)
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1020

Should make sure the TotalSize of Microcode is aligned with 4 bytes
before calling CalculateSum32 function.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Chen A Chen <chen.a.chen@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
UefiCpuPkg/Library/MpInitLib/Microcode.c

index 5f9ae22..643a6f9 100644 (file)
@@ -166,20 +166,29 @@ MicrocodeDetect (
     //\r
     CorrectMicrocode = FALSE;\r
 \r
-    //\r
-    // Save an in-complete CheckSum32 from CheckSum Part1 for common parts.\r
-    //\r
     if (MicrocodeEntryPoint->DataSize == 0) {\r
-      InCompleteCheckSum32 = CalculateSum32 (\r
-                               (UINT32 *) MicrocodeEntryPoint,\r
-                               sizeof (CPU_MICROCODE_HEADER) + 2000\r
-                               );\r
+      TotalSize = sizeof (CPU_MICROCODE_HEADER) + 2000;\r
     } else {\r
-      InCompleteCheckSum32 = CalculateSum32 (\r
-                               (UINT32 *) MicrocodeEntryPoint,\r
-                               sizeof (CPU_MICROCODE_HEADER) + MicrocodeEntryPoint->DataSize\r
-                               );\r
+      TotalSize = sizeof (CPU_MICROCODE_HEADER) + MicrocodeEntryPoint->DataSize;\r
     }\r
+\r
+    ///\r
+    /// Check overflow and whether TotalSize is aligned with 4 bytes.\r
+    ///\r
+    if ( ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd ||\r
+         (TotalSize & 0x3) != 0\r
+       ) {\r
+      MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN) MicrocodeEntryPoint) + SIZE_1KB);\r
+      continue;\r
+    }\r
+\r
+    //\r
+    // Save an in-complete CheckSum32 from CheckSum Part1 for common parts.\r
+    //\r
+    InCompleteCheckSum32 = CalculateSum32 (\r
+                             (UINT32 *) MicrocodeEntryPoint,\r
+                             TotalSize\r
+                             );\r
     InCompleteCheckSum32 -= MicrocodeEntryPoint->ProcessorSignature.Uint32;\r
     InCompleteCheckSum32 -= MicrocodeEntryPoint->ProcessorFlags;\r
     InCompleteCheckSum32 -= MicrocodeEntryPoint->Checksum;\r