1) Fix buffer overflow in JUMP_BUFFER in the DXE Core StartImage()

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@2035 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/EdkModulePkg/Core/Dxe/Image/Image.c b/EdkModulePkg/Core/Dxe/Image/Image.c
index 9d585a94ea4b52ea8a5fafa219fc2af9c2b36554..a71c6f643a6321965428a4814263522e18f77e2f 100644 (file)
--- a/EdkModulePkg/Core/Dxe/Image/Image.c
+++ b/EdkModulePkg/Core/Dxe/Image/Image.c
@@ -953,12 +953,12 @@ Returns:
   // JumpContext must be aligned on a CPU specific boundary.\r
   // Overallocate the buffer and force the required alignment\r
   //\r
   // JumpContext must be aligned on a CPU specific boundary.\r
   // Overallocate the buffer and force the required alignment\r
   //\r

-  Image->JumpBuffer = CoreAllocateBootServicesPool (sizeof (*Image->JumpContext) + BASE_LIBRARY_JUMP_BUFFER_ALIGNMENT);\r
+  Image->JumpBuffer = CoreAllocateBootServicesPool (sizeof (BASE_LIBRARY_JUMP_BUFFER) + BASE_LIBRARY_JUMP_BUFFER_ALIGNMENT);\r

   if (Image->JumpBuffer == NULL) {\r
     PERF_END (ImageHandle, START_IMAGE_TOK, NULL, 0);\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r
   if (Image->JumpBuffer == NULL) {\r
     PERF_END (ImageHandle, START_IMAGE_TOK, NULL, 0);\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r

-  Image->JumpContext = (VOID *)((UINTN)(ALIGN_POINTER (Image->JumpBuffer, BASE_LIBRARY_JUMP_BUFFER_ALIGNMENT)) + BASE_LIBRARY_JUMP_BUFFER_ALIGNMENT);\r
+  Image->JumpContext = ALIGN_POINTER (Image->JumpBuffer, BASE_LIBRARY_JUMP_BUFFER_ALIGNMENT);\r

 \r
   SetJumpFlag = SetJump (Image->JumpContext);\r
   //\r
 \r
   SetJumpFlag = SetJump (Image->JumpContext);\r
   //\r