MdeModulePkg/NonDiscoverable: fix memory override bug

For PciIoPciRead interface, memory prior to Buffer would be written
with zeros if Offset was larger than sizeof (Dev->ConfigSpace), which
would cause serious system exception.

So we add a pre-check branch to avoid memory override.

Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Heyi Guo <heyi.guo@linaro.org>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

diff --git a/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePciDeviceIo.c b/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePciDeviceIo.c
index c836ad6a9162fa7b2b346598cb42932263a7f9c7..0e42ae4bf6ecd87175e87bab67dfb3812aee895e 100644 (file)
--- a/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePciDeviceIo.c
+++ b/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePciDeviceIo.c
@@ -465,6 +465,11 @@ PciIoPciRead (
   Address = (UINT8 *)&Dev->ConfigSpace + Offset;\r
   Length = Count << ((UINTN)Width & 0x3);\r
 \r
   Address = (UINT8 *)&Dev->ConfigSpace + Offset;\r
   Length = Count << ((UINTN)Width & 0x3);\r
 \r

+  if (Offset >= sizeof (Dev->ConfigSpace)) {\r
+    ZeroMem (Buffer, Length);\r
+    return EFI_SUCCESS;\r
+  }\r
+\r

   if (Offset + Length > sizeof (Dev->ConfigSpace)) {\r
     //\r
     // Read all zeroes for config space accesses beyond the first\r
   if (Offset + Length > sizeof (Dev->ConfigSpace)) {\r
     //\r
     // Read all zeroes for config space accesses beyond the first\r