ArmPkg/ArmMmuLib AARCH64: fix out of bounds access

Take care not to dereference BlockEntry if it may be pointing past
the end of the page table we are manipulating. It is only a read,
and thus harmless, but HeapGuard triggers on it so let's fix it.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>

diff --git a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
index e41044142ef420f885339461601fcd8e8b7313dd..d66df3e17a02a17c71b4ff947963de3f584320a6 100644 (file)
--- a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
+++ b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
@@ -382,7 +382,7 @@ UpdateRegionMapping (
 \r
       // Break the inner loop when next block is a table\r
       // Rerun GetBlockEntryListFromAddress to avoid page table memory leak\r
-      if (TableLevel != 3 &&\r
+      if (TableLevel != 3 && BlockEntry <= LastBlockEntry &&\r
           (*BlockEntry & TT_TYPE_MASK) == TT_TYPE_TABLE_ENTRY) {\r
             break;\r
       }\r