Add more exact SMM check in SmmFaultTolerantWriteHandler.

Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Elvin Li <elvin.li@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13763 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
index 2537d22e2c2a7431ceddc14e7a4d39789d8d9175..e7d79c1aa57c0b7b84efec87347dc799b902a7eb 100644 (file)
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
@@ -337,9 +337,19 @@ SmmFaultTolerantWriteHandler (
   SMM_FTW_GET_LAST_WRITE_HEADER                    *SmmFtwGetLastWriteHeader;\r
   VOID                                             *PrivateData;\r
   EFI_HANDLE                                       SmmFvbHandle;\r
+  UINTN                                            InfoSize;\r
 \r
-  ASSERT (CommBuffer != NULL);\r
-  ASSERT (CommBufferSize != NULL);\r
+\r
+  //\r
+  // If input is invalid, stop processing this SMI\r
+  //\r
+  if (CommBuffer == NULL || CommBufferSize == NULL) {\r
+    return EFI_SUCCESS;\r
+  }\r
+\r
+  if (*CommBufferSize < SMM_FTW_COMMUNICATE_HEADER_SIZE) {\r
+    return EFI_SUCCESS;\r
+  }\r
 \r
   if (InternalIsAddressInSmram ((EFI_PHYSICAL_ADDRESS)(UINTN)CommBuffer, *CommBufferSize)) {\r
     DEBUG ((EFI_D_ERROR, "SMM communication buffer size is in SMRAM!\n"));\r
@@ -349,7 +359,18 @@ SmmFaultTolerantWriteHandler (
   SmmFtwFunctionHeader = (SMM_FTW_COMMUNICATE_FUNCTION_HEADER *)CommBuffer;\r
   switch (SmmFtwFunctionHeader->Function) {\r
     case FTW_FUNCTION_GET_MAX_BLOCK_SIZE:\r
-      SmmGetMaxBlockSizeHeader = (SMM_FTW_GET_MAX_BLOCK_SIZE_HEADER *) SmmFtwFunctionHeader->Data;     \r
+      SmmGetMaxBlockSizeHeader = (SMM_FTW_GET_MAX_BLOCK_SIZE_HEADER *) SmmFtwFunctionHeader->Data;\r
+      InfoSize = sizeof (SMM_FTW_GET_MAX_BLOCK_SIZE_HEADER);\r
+\r
+      //\r
+      // SMRAM range check already covered before\r
+      //\r
+      if (InfoSize > *CommBufferSize - SMM_FTW_COMMUNICATE_HEADER_SIZE) {\r
+        DEBUG ((EFI_D_ERROR, "Data size exceed communication buffer size limit!\n"));\r
+        Status = EFI_ACCESS_DENIED;\r
+        break;\r
+      }\r
+\r
       Status = FtwGetMaxBlockSize (\r
                  &mFtwDevice->FtwInstance,\r
                  &SmmGetMaxBlockSizeHeader->BlockSize\r
@@ -409,21 +430,27 @@ SmmFaultTolerantWriteHandler (
       \r
     case FTW_FUNCTION_GET_LAST_WRITE:\r
       SmmFtwGetLastWriteHeader = (SMM_FTW_GET_LAST_WRITE_HEADER *) SmmFtwFunctionHeader->Data;\r
-      if (((UINT8*)SmmFtwGetLastWriteHeader->Data > (UINT8*)CommBuffer) &&  \r
-          ((UINT8*)SmmFtwGetLastWriteHeader->Data + SmmFtwGetLastWriteHeader->PrivateDataSize <= (UINT8*)CommBuffer + (*CommBufferSize))) {\r
-        Status = FtwGetLastWrite (\r
-                   &mFtwDevice->FtwInstance,\r
-                   &SmmFtwGetLastWriteHeader->CallerId,\r
-                   &SmmFtwGetLastWriteHeader->Lba,\r
-                   &SmmFtwGetLastWriteHeader->Offset,\r
-                   &SmmFtwGetLastWriteHeader->Length,\r
-                   &SmmFtwGetLastWriteHeader->PrivateDataSize,\r
-                   (VOID *)SmmFtwGetLastWriteHeader->Data,\r
-                   &SmmFtwGetLastWriteHeader->Complete\r
-                   );\r
-      } else  {\r
-        Status = EFI_INVALID_PARAMETER;\r
+      InfoSize = OFFSET_OF (SMM_FTW_GET_LAST_WRITE_HEADER, Data) + SmmFtwGetLastWriteHeader->PrivateDataSize;\r
+\r
+      //\r
+      // SMRAM range check already covered before\r
+      //\r
+      if (InfoSize > *CommBufferSize - SMM_FTW_COMMUNICATE_HEADER_SIZE) {\r
+        DEBUG ((EFI_D_ERROR, "Data size exceed communication buffer size limit!\n"));\r
+        Status = EFI_ACCESS_DENIED;\r
+        break;\r
       }\r
+\r
+      Status = FtwGetLastWrite (\r
+                 &mFtwDevice->FtwInstance,\r
+                 &SmmFtwGetLastWriteHeader->CallerId,\r
+                 &SmmFtwGetLastWriteHeader->Lba,\r
+                 &SmmFtwGetLastWriteHeader->Offset,\r
+                 &SmmFtwGetLastWriteHeader->Length,\r
+                 &SmmFtwGetLastWriteHeader->PrivateDataSize,\r
+                 (VOID *)SmmFtwGetLastWriteHeader->Data,\r
+                 &SmmFtwGetLastWriteHeader->Complete\r
+                 );\r
       break;\r
 \r
     default:\r