MdeModulePkg/SecurityPkg Variable: Add boundary check for while (IsValidVariableHeade...

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16280 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Universal/Variable/Pei/Variable.c b/MdeModulePkg/Universal/Variable/Pei/Variable.c
index df0304748c1a871bbbc81eb8b83b3d5123053dc6..4716cc5124a6837f9d650eb8646b533f763c48a3 100644 (file)
--- a/MdeModulePkg/Universal/Variable/Pei/Variable.c
+++ b/MdeModulePkg/Universal/Variable/Pei/Variable.c
@@ -3,7 +3,7 @@
   Implement ReadOnly Variable Services required by PEIM and install\r
   PEI ReadOnly Varaiable2 PPI. These services operates the non volatile storage space.\r
 \r
-Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -547,14 +547,25 @@ GetVariableHeader (
   EFI_HOB_GUID_TYPE     *GuidHob;\r
   UINTN                 PartialHeaderSize;\r
 \r
+  if (Variable == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
    //\r
    // First assume variable header pointed by Variable is consecutive.\r
    //\r
   *VariableHeader = Variable;\r
 \r
-  if ((Variable != NULL) && (StoreInfo->FtwLastWriteData != NULL)) {\r
+  if (StoreInfo->FtwLastWriteData != NULL) {\r
     TargetAddress = StoreInfo->FtwLastWriteData->TargetAddress;\r
     SpareAddress = StoreInfo->FtwLastWriteData->SpareAddress;\r
+    if (((UINTN) Variable > (UINTN) SpareAddress) &&\r
+        (((UINTN) Variable - (UINTN) SpareAddress + (UINTN) TargetAddress) >= (UINTN) GetEndPointer (StoreInfo->VariableStoreHeader))) {\r
+      //\r
+      // Reach the end of variable store.\r
+      //\r
+      return FALSE;\r
+    }\r
     if (((UINTN) Variable < (UINTN) TargetAddress) && (((UINTN) Variable + sizeof (VARIABLE_HEADER)) > (UINTN) TargetAddress)) {\r
       //\r
       // Variable header pointed by Variable is inconsecutive,\r
@@ -576,6 +587,13 @@ GetVariableHeader (
         CopyMem ((UINT8 *) *VariableHeader + PartialHeaderSize, (UINT8 *) (UINTN) SpareAddress, sizeof (VARIABLE_HEADER) - PartialHeaderSize);\r
       }\r
     }\r
+  } else {\r
+    if (Variable >= GetEndPointer (StoreInfo->VariableStoreHeader)) {\r
+      //\r
+      // Reach the end of variable store.\r
+      //\r
+      return FALSE;\r
+    }\r
   }\r
 \r
   return IsValidVariableHeader (*VariableHeader);\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
index fc7fbab5d6d024c50264795364f4dc35411c1f24..c66bdbf9fd9095da386706470e8f1d38b40296da 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
@@ -190,18 +190,24 @@ UpdateVariableInfo (
 \r
   This code checks if variable header is valid or not.\r
 \r
-  @param Variable        Pointer to the Variable Header.\r
+  @param Variable           Pointer to the Variable Header.\r
+  @param VariableStoreEnd   Pointer to the Variable Store End.\r
 \r
-  @retval TRUE           Variable header is valid.\r
-  @retval FALSE          Variable header is not valid.\r
+  @retval TRUE              Variable header is valid.\r
+  @retval FALSE             Variable header is not valid.\r
 \r
 **/\r
 BOOLEAN\r
 IsValidVariableHeader (\r
-  IN  VARIABLE_HEADER   *Variable\r
+  IN  VARIABLE_HEADER       *Variable,\r
+  IN  VARIABLE_HEADER       *VariableStoreEnd\r
   )\r
 {\r
-  if (Variable == NULL || Variable->StartId != VARIABLE_DATA) {\r
+  if ((Variable == NULL) || (Variable >= VariableStoreEnd) || (Variable->StartId != VARIABLE_DATA)) {\r
+    //\r
+    // Variable is NULL or has reached the end of variable store,\r
+    // or the StartId is not correct.\r
+    //\r
     return FALSE;\r
   }\r
 \r
@@ -499,10 +505,6 @@ GetNextVariablePtr (
 {\r
   UINTN Value;\r
 \r
-  if (!IsValidVariableHeader (Variable)) {\r
-    return NULL;\r
-  }\r
-\r
   Value =  (UINTN) GetVariableDataPtr (Variable);\r
   Value += DataSizeOfVariable (Variable);\r
   Value += GET_PAD_SIZE (DataSizeOfVariable (Variable));\r
@@ -622,7 +624,7 @@ Reclaim (
     Variable          = GetStartPointer (VariableStoreHeader);\r
     MaximumBufferSize = sizeof (VARIABLE_STORE_HEADER);\r
 \r
-    while (IsValidVariableHeader (Variable)) {\r
+    while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
       NextVariable = GetNextVariablePtr (Variable);\r
       if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) &&\r
           Variable != UpdatingVariable &&\r
@@ -672,7 +674,7 @@ Reclaim (
   // Reinstall all ADDED variables as long as they are not identical to Updating Variable.\r
   // \r
   Variable = GetStartPointer (VariableStoreHeader);\r
-  while (IsValidVariableHeader (Variable)) {\r
+  while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
     NextVariable = GetNextVariablePtr (Variable);\r
     if (Variable != UpdatingVariable && Variable->State == VAR_ADDED) {\r
       VariableSize = (UINTN) NextVariable - (UINTN) Variable;\r
@@ -691,7 +693,7 @@ Reclaim (
   // Reinstall all in delete transition variables.\r
   // \r
   Variable = GetStartPointer (VariableStoreHeader);\r
-  while (IsValidVariableHeader (Variable)) {\r
+  while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
     NextVariable = GetNextVariablePtr (Variable);\r
     if (Variable != UpdatingVariable && Variable != UpdatingInDeletedTransition && Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {\r
 \r
@@ -703,7 +705,7 @@ Reclaim (
      \r
       FoundAdded = FALSE;\r
       AddedVariable = GetStartPointer ((VARIABLE_STORE_HEADER *) ValidBuffer);\r
-      while (IsValidVariableHeader (AddedVariable)) {\r
+      while (IsValidVariableHeader (AddedVariable, GetEndPointer ((VARIABLE_STORE_HEADER *) ValidBuffer))) {\r
         NextAddedVariable = GetNextVariablePtr (AddedVariable);\r
         NameSize = NameSizeOfVariable (AddedVariable);\r
         if (CompareGuid (&AddedVariable->VendorGuid, &Variable->VendorGuid) &&\r
@@ -795,7 +797,7 @@ Reclaim (
       mVariableModuleGlobal->CommonVariableTotalSize = CommonVariableTotalSize;\r
     } else {\r
       NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableBase);\r
-      while (IsValidVariableHeader (NextVariable)) {\r
+      while (IsValidVariableHeader (NextVariable, GetEndPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableBase))) {\r
         VariableSize = NextVariable->NameSize + NextVariable->DataSize + sizeof (VARIABLE_HEADER);\r
         if ((Variable->Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == EFI_VARIABLE_HARDWARE_ERROR_RECORD) {\r
           mVariableModuleGlobal->HwErrVariableTotalSize += HEADER_ALIGN (VariableSize);\r
@@ -853,7 +855,7 @@ FindVariableEx (
   InDeletedVariable  = NULL;\r
 \r
   for ( PtrTrack->CurrPtr = PtrTrack->StartPtr\r
-      ; (PtrTrack->CurrPtr < PtrTrack->EndPtr) && IsValidVariableHeader (PtrTrack->CurrPtr)\r
+      ; IsValidVariableHeader (PtrTrack->CurrPtr, PtrTrack->EndPtr)\r
       ; PtrTrack->CurrPtr = GetNextVariablePtr (PtrTrack->CurrPtr)\r
       ) {\r
     if (PtrTrack->CurrPtr->State == VAR_ADDED || \r
@@ -2408,10 +2410,7 @@ VariableServiceGetNextVariableName (
     //\r
     // Switch from Volatile to HOB, to Non-Volatile.\r
     //\r
-    while ((Variable.CurrPtr >= Variable.EndPtr) ||\r
-           (Variable.CurrPtr == NULL)            ||\r
-           !IsValidVariableHeader (Variable.CurrPtr)\r
-          ) {\r
+    while (!IsValidVariableHeader (Variable.CurrPtr, Variable.EndPtr)) {\r
       //\r
       // Find current storage index\r
       //\r
@@ -2617,8 +2616,7 @@ VariableServiceSetVariable (
     // Parse non-volatile variable data and get last variable offset.\r
     //\r
     NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point);\r
-    while ((NextVariable < GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point)) \r
-        && IsValidVariableHeader (NextVariable)) {\r
+    while (IsValidVariableHeader (NextVariable, GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point))) {\r
       NextVariable = GetNextVariablePtr (NextVariable);\r
     }\r
     mVariableModuleGlobal->NonVolatileLastVariableOffset = (UINTN) NextVariable - (UINTN) Point;\r
@@ -2765,7 +2763,7 @@ VariableServiceQueryVariableInfoInternal (
   //\r
   // Now walk through the related variable store.\r
   //\r
-  while ((Variable < GetEndPointer (VariableStoreHeader)) && IsValidVariableHeader (Variable)) {\r
+  while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
     NextVariable = GetNextVariablePtr (Variable);\r
     VariableSize = (UINT64) (UINTN) NextVariable - (UINT64) (UINTN) Variable;\r
 \r
@@ -3063,7 +3061,7 @@ InitNonVolatileVariableStore (
   // Parse non-volatile variable data and get last variable offset.\r
   //\r
   NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableStoreBase);\r
-  while (IsValidVariableHeader (NextVariable)) {\r
+  while (IsValidVariableHeader (NextVariable, GetEndPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableStoreBase))) {\r
     VariableSize = NextVariable->NameSize + NextVariable->DataSize + sizeof (VARIABLE_HEADER);\r
     if ((NextVariable->Attributes & (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_HARDWARE_ERROR_RECORD)) == (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_HARDWARE_ERROR_RECORD)) {\r
       mVariableModuleGlobal->HwErrVariableTotalSize += HEADER_ALIGN (VariableSize);\r
@@ -3109,7 +3107,7 @@ FlushHobVariableToFlash (
     //\r
     mVariableModuleGlobal->VariableGlobal.HobVariableBase = 0;\r
     for ( Variable = GetStartPointer (VariableStoreHeader)\r
-        ; (Variable < GetEndPointer (VariableStoreHeader) && IsValidVariableHeader (Variable))\r
+        ; IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))\r
         ; Variable = GetNextVariablePtr (Variable)\r
         ) {\r
       if (Variable->State != VAR_ADDED) {\r

diff --git a/SecurityPkg/VariableAuthenticated/Pei/Variable.c b/SecurityPkg/VariableAuthenticated/Pei/Variable.c
index 274feb31aca168a29181d036f2b3d13cb1ac337c..7ead809a3ba4b9d6e992d167e97db3a9450f5b62 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/Pei/Variable.c
+++ b/SecurityPkg/VariableAuthenticated/Pei/Variable.c
@@ -3,7 +3,7 @@
   ReadOnly Varaiable2 PPI. These services operates the non-volatile \r
   storage space.\r
 \r
-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 which accompanies this distribution.  The full text of the license may be found at \r
@@ -546,14 +546,25 @@ GetVariableHeader (
   EFI_HOB_GUID_TYPE     *GuidHob;\r
   UINTN                 PartialHeaderSize;\r
 \r
+  if (Variable == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
    //\r
    // First assume variable header pointed by Variable is consecutive.\r
    //\r
   *VariableHeader = Variable;\r
 \r
-  if ((Variable != NULL) && (StoreInfo->FtwLastWriteData != NULL)) {\r
+  if (StoreInfo->FtwLastWriteData != NULL) {\r
     TargetAddress = StoreInfo->FtwLastWriteData->TargetAddress;\r
     SpareAddress = StoreInfo->FtwLastWriteData->SpareAddress;\r
+    if (((UINTN) Variable > (UINTN) SpareAddress) &&\r
+        (((UINTN) Variable - (UINTN) SpareAddress + (UINTN) TargetAddress) >= (UINTN) GetEndPointer (StoreInfo->VariableStoreHeader))) {\r
+      //\r
+      // Reach the end of variable store.\r
+      //\r
+      return FALSE;\r
+    }\r
     if (((UINTN) Variable < (UINTN) TargetAddress) && (((UINTN) Variable + sizeof (VARIABLE_HEADER)) > (UINTN) TargetAddress)) {\r
       //\r
       // Variable header pointed by Variable is inconsecutive,\r
@@ -575,6 +586,13 @@ GetVariableHeader (
         CopyMem ((UINT8 *) *VariableHeader + PartialHeaderSize, (UINT8 *) (UINTN) SpareAddress, sizeof (VARIABLE_HEADER) - PartialHeaderSize);\r
       }\r
     }\r
+  } else {\r
+    if (Variable >= GetEndPointer (StoreInfo->VariableStoreHeader)) {\r
+      //\r
+      // Reach the end of variable store.\r
+      //\r
+      return FALSE;\r
+    }\r
   }\r
 \r
   return IsValidVariableHeader (*VariableHeader);\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
index 6b9ca960b6b34eb1c942398892fa26ea3883491c..cb0f2baf9d3ff8f79f193406b6cb13d7a2691826 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
@@ -218,18 +218,24 @@ UpdateVariableInfo (
 \r
   This code checks if variable header is valid or not.\r
 \r
-  @param Variable        Pointer to the Variable Header.\r
+  @param Variable           Pointer to the Variable Header.\r
+  @param VariableStoreEnd   Pointer to the Variable Store End.\r
 \r
-  @retval TRUE           Variable header is valid.\r
-  @retval FALSE          Variable header is not valid.\r
+  @retval TRUE              Variable header is valid.\r
+  @retval FALSE             Variable header is not valid.\r
 \r
 **/\r
 BOOLEAN\r
 IsValidVariableHeader (\r
-  IN  VARIABLE_HEADER   *Variable\r
+  IN  VARIABLE_HEADER       *Variable,\r
+  IN  VARIABLE_HEADER       *VariableStoreEnd\r
   )\r
 {\r
-  if (Variable == NULL || Variable->StartId != VARIABLE_DATA) {\r
+  if ((Variable == NULL) || (Variable >= VariableStoreEnd) || (Variable->StartId != VARIABLE_DATA)) {\r
+    //\r
+    // Variable is NULL or has reached the end of variable store,\r
+    // or the StartId is not correct.\r
+    //\r
     return FALSE;\r
   }\r
 \r
@@ -529,10 +535,6 @@ GetNextVariablePtr (
 {\r
   UINTN Value;\r
 \r
-  if (!IsValidVariableHeader (Variable)) {\r
-    return NULL;\r
-  }\r
-\r
   Value =  (UINTN) GetVariableDataPtr (Variable);\r
   Value += DataSizeOfVariable (Variable);\r
   Value += GET_PAD_SIZE (DataSizeOfVariable (Variable));\r
@@ -605,14 +607,16 @@ IsValidPubKeyIndex (
   )\r
 {\r
   VARIABLE_HEADER          *Variable;\r
+  VARIABLE_HEADER          *VariableStoreEnd;\r
 \r
   if (PubKeyIndex > mPubKeyNumber) {\r
     return FALSE;\r
   }\r
-  \r
+\r
   Variable = GetStartPointer ((VARIABLE_STORE_HEADER *) (UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);\r
-  \r
-  while (IsValidVariableHeader (Variable)) {\r
+  VariableStoreEnd = GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);\r
+\r
+  while (IsValidVariableHeader (Variable, VariableStoreEnd)) {\r
     if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) && \r
         Variable->PubKeyIndex == PubKeyIndex) {\r
       return TRUE;\r
@@ -799,7 +803,7 @@ Reclaim (
     Variable          = GetStartPointer (VariableStoreHeader);\r
     MaximumBufferSize = sizeof (VARIABLE_STORE_HEADER);\r
 \r
-    while (IsValidVariableHeader (Variable)) {\r
+    while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
       NextVariable = GetNextVariablePtr (Variable);\r
       if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) &&\r
           Variable != UpdatingVariable &&\r
@@ -866,7 +870,7 @@ Reclaim (
     // Refresh the PubKeyIndex for all valid variables (ADDED and IN_DELETED_TRANSITION).\r
     //\r
     Variable = GetStartPointer (VariableStoreHeader);\r
-    while (IsValidVariableHeader (Variable)) {\r
+    while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
       NextVariable = GetNextVariablePtr (Variable);\r
       if (Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {\r
         if ((StrCmp (GetVariableNamePtr (Variable), AUTHVAR_KEYDB_NAME) == 0) && \r
@@ -912,7 +916,7 @@ Reclaim (
     // Reinstall all ADDED variables as long as they are not identical to Updating Variable.\r
     //\r
     Variable = GetStartPointer (VariableStoreHeader);\r
-    while (IsValidVariableHeader (Variable)) {\r
+    while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
       NextVariable = GetNextVariablePtr (Variable);\r
       if (Variable != UpdatingVariable && Variable->State == VAR_ADDED) {\r
         VariableSize = (UINTN) NextVariable - (UINTN) Variable;\r
@@ -931,7 +935,7 @@ Reclaim (
     // Reinstall all in delete transition variables.\r
     //\r
     Variable = GetStartPointer (VariableStoreHeader);\r
-    while (IsValidVariableHeader (Variable)) {\r
+    while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
       NextVariable = GetNextVariablePtr (Variable);\r
       if (Variable != UpdatingVariable && Variable != UpdatingInDeletedTransition && Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {\r
 \r
@@ -943,7 +947,7 @@ Reclaim (
 \r
         FoundAdded = FALSE;\r
         AddedVariable = GetStartPointer ((VARIABLE_STORE_HEADER *) ValidBuffer);\r
-        while (IsValidVariableHeader (AddedVariable)) {\r
+        while (IsValidVariableHeader (AddedVariable, GetEndPointer ((VARIABLE_STORE_HEADER *) ValidBuffer))) {\r
           NextAddedVariable = GetNextVariablePtr (AddedVariable);\r
           NameSize = NameSizeOfVariable (AddedVariable);\r
           if (CompareGuid (&AddedVariable->VendorGuid, &Variable->VendorGuid) &&\r
@@ -1036,7 +1040,7 @@ Reclaim (
       mVariableModuleGlobal->CommonVariableTotalSize = CommonVariableTotalSize;\r
     } else {\r
       NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableBase);\r
-      while (IsValidVariableHeader (NextVariable)) {\r
+      while (IsValidVariableHeader (NextVariable, GetEndPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableBase))) {\r
         VariableSize = NextVariable->NameSize + NextVariable->DataSize + sizeof (VARIABLE_HEADER);\r
         if ((Variable->Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == EFI_VARIABLE_HARDWARE_ERROR_RECORD) {\r
           mVariableModuleGlobal->HwErrVariableTotalSize += HEADER_ALIGN (VariableSize);\r
@@ -1102,7 +1106,7 @@ FindVariableEx (
   InDeletedVariable  = NULL;\r
 \r
   for ( PtrTrack->CurrPtr = PtrTrack->StartPtr\r
-      ; (PtrTrack->CurrPtr < PtrTrack->EndPtr) && IsValidVariableHeader (PtrTrack->CurrPtr)\r
+      ; IsValidVariableHeader (PtrTrack->CurrPtr, PtrTrack->EndPtr)\r
       ; PtrTrack->CurrPtr = GetNextVariablePtr (PtrTrack->CurrPtr)\r
       ) {\r
     if (PtrTrack->CurrPtr->State == VAR_ADDED ||\r
@@ -2867,10 +2871,7 @@ VariableServiceGetNextVariableName (
     //\r
     // Switch from Volatile to HOB, to Non-Volatile.\r
     //\r
-    while ((Variable.CurrPtr >= Variable.EndPtr) ||\r
-           (Variable.CurrPtr == NULL)            ||\r
-           !IsValidVariableHeader (Variable.CurrPtr)\r
-          ) {\r
+    while (!IsValidVariableHeader (Variable.CurrPtr, Variable.EndPtr)) {\r
       //\r
       // Find current storage index\r
       //\r
@@ -3119,8 +3120,7 @@ VariableServiceSetVariable (
     // Parse non-volatile variable data and get last variable offset.\r
     //\r
     NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point);\r
-    while ((NextVariable < GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point))\r
-        && IsValidVariableHeader (NextVariable)) {\r
+    while (IsValidVariableHeader (NextVariable, GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point))) {\r
       NextVariable = GetNextVariablePtr (NextVariable);\r
     }\r
     mVariableModuleGlobal->NonVolatileLastVariableOffset = (UINTN) NextVariable - (UINTN) Point;\r
@@ -3294,7 +3294,7 @@ VariableServiceQueryVariableInfoInternal (
   //\r
   // Now walk through the related variable store.\r
   //\r
-  while ((Variable < GetEndPointer (VariableStoreHeader)) && IsValidVariableHeader (Variable)) {\r
+  while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
     NextVariable = GetNextVariablePtr (Variable);\r
     VariableSize = (UINT64) (UINTN) NextVariable - (UINT64) (UINTN) Variable;\r
 \r
@@ -3594,7 +3594,7 @@ InitNonVolatileVariableStore (
   // Parse non-volatile variable data and get last variable offset.\r
   //\r
   NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableStoreBase);\r
-  while (IsValidVariableHeader (NextVariable)) {\r
+  while (IsValidVariableHeader (NextVariable, GetEndPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableStoreBase))) {\r
     VariableSize = NextVariable->NameSize + NextVariable->DataSize + sizeof (VARIABLE_HEADER);\r
     if ((NextVariable->Attributes & (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_HARDWARE_ERROR_RECORD)) == (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_HARDWARE_ERROR_RECORD)) {\r
       mVariableModuleGlobal->HwErrVariableTotalSize += HEADER_ALIGN (VariableSize);\r
@@ -3640,7 +3640,7 @@ FlushHobVariableToFlash (
     //\r
     mVariableModuleGlobal->VariableGlobal.HobVariableBase = 0;\r
     for ( Variable = GetStartPointer (VariableStoreHeader)\r
-        ; (Variable < GetEndPointer (VariableStoreHeader) && IsValidVariableHeader (Variable))\r
+        ; IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))\r
         ; Variable = GetNextVariablePtr (Variable)\r
         ) {\r
       if (Variable->State != VAR_ADDED) {\r