Add code to check boot option variable before use it

Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Ni Ruiyu <ruiyu.ni@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13203 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsBoot.c b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsBoot.c
index 6f06ac9a850d3ea2546df6c14553a01b0056abb8..c9c694e6482b5674a9b8d71644f41867bd19f6ef 100644 (file)
--- a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsBoot.c
+++ b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsBoot.c
@@ -1238,6 +1238,13 @@ BdsLibDeleteOptionFromHandle (
       return EFI_OUT_OF_RESOURCES;\r
     }\r
 \r
+    if (!ValidateOption(BootOptionVar, BootOptionSize)) {\r
+      BdsDeleteBootOption (BootOrder[Index], BootOrder, &BootOrderSize);\r
+      FreePool (BootOptionVar);\r
+      Index++;\r
+      continue;\r
+    }\r
+\r
     TempPtr = BootOptionVar;\r
     TempPtr += sizeof (UINT32) + sizeof (UINT16);\r
     TempPtr += StrSize ((CHAR16 *) TempPtr);\r
@@ -1300,10 +1307,14 @@ BdsDeleteAllInvalidEfiBootOption (
   EFI_DEVICE_PATH_PROTOCOL  *OptionDevicePath;\r
   UINT8                     *TempPtr;\r
   CHAR16                    *Description;\r
+  BOOLEAN                   Corrupted;\r
 \r
-  Status        = EFI_SUCCESS;\r
-  BootOrder     = NULL;\r
-  BootOrderSize = 0;\r
+  Status           = EFI_SUCCESS;\r
+  BootOrder        = NULL;\r
+  Description      = NULL;\r
+  OptionDevicePath = NULL;\r
+  BootOrderSize    = 0;\r
+  Corrupted        = FALSE;\r
 \r
   //\r
   // Check "BootOrder" variable firstly, this variable hold the number of boot options\r
@@ -1330,23 +1341,27 @@ BdsDeleteAllInvalidEfiBootOption (
       return EFI_OUT_OF_RESOURCES;\r
     }\r
 \r
-    TempPtr = BootOptionVar;\r
-    TempPtr += sizeof (UINT32) + sizeof (UINT16);\r
-    Description = (CHAR16 *) TempPtr;\r
-    TempPtr += StrSize ((CHAR16 *) TempPtr);\r
-    OptionDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) TempPtr;\r
+    if (!ValidateOption(BootOptionVar, BootOptionSize)) {\r
+      Corrupted = TRUE;\r
+    } else {\r
+      TempPtr = BootOptionVar;\r
+      TempPtr += sizeof (UINT32) + sizeof (UINT16);\r
+      Description = (CHAR16 *) TempPtr;\r
+      TempPtr += StrSize ((CHAR16 *) TempPtr);\r
+      OptionDevicePath = (EFI_DEVICE_PATH_PROTOCOL *) TempPtr;\r
 \r
-    //\r
-    // Skip legacy boot option (BBS boot device)\r
-    //\r
-    if ((DevicePathType (OptionDevicePath) == BBS_DEVICE_PATH) &&\r
-        (DevicePathSubType (OptionDevicePath) == BBS_BBS_DP)) {\r
-      FreePool (BootOptionVar);\r
-      Index++;\r
-      continue;\r
+      //\r
+      // Skip legacy boot option (BBS boot device)\r
+      //\r
+      if ((DevicePathType (OptionDevicePath) == BBS_DEVICE_PATH) &&\r
+          (DevicePathSubType (OptionDevicePath) == BBS_BBS_DP)) {\r
+        FreePool (BootOptionVar);\r
+        Index++;\r
+        continue;\r
+      }\r
     }\r
 \r
-    if (!BdsLibIsValidEFIBootOptDevicePathExt (OptionDevicePath, FALSE, Description)) {\r
+    if (Corrupted || !BdsLibIsValidEFIBootOptDevicePathExt (OptionDevicePath, FALSE, Description)) {\r
       //\r
       // Delete this invalid boot option "Boot####"\r
       //\r
@@ -1361,6 +1376,7 @@ BdsDeleteAllInvalidEfiBootOption (
       // Mark this boot option in boot order as deleted\r
       //\r
       BootOrder[Index] = 0xffff;\r
+      Corrupted        = FALSE;\r
     }\r
 \r
     FreePool (BootOptionVar);\r

diff --git a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c
index 15a47e1917ea98893f35b887a43ad1967b43b890..9993e4b19d4bdfcfc242c45af99ecd43d2f2bfc2 100644 (file)
--- a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c
+++ b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c
@@ -257,6 +257,14 @@ BdsLibRegisterNewOption (
     if (OptionPtr == NULL) {\r
       continue;\r
     }\r
+\r
+    //\r
+    // Validate the variable.\r
+    //\r
+    if (!ValidateOption(OptionPtr, OptionSize)) {\r
+      continue;\r
+    }\r
+\r
     TempPtr         =   OptionPtr;\r
     TempPtr         +=  sizeof (UINT32) + sizeof (UINT16);\r
     Description     =   (CHAR16 *) TempPtr;\r
@@ -425,7 +433,7 @@ GetDevicePathSizeEx (
   Size = 0;\r
   while (!IsDevicePathEnd (DevicePath)) {\r
     NodeSize = DevicePathNodeLength (DevicePath);\r
-    if (NodeSize == 0) {\r
+    if (NodeSize < END_DEVICE_PATH_LENGTH) {\r
       return 0;\r
     }\r
     Size += NodeSize;\r
@@ -480,6 +488,76 @@ StrSizeEx (
   return (Length + 1) * sizeof (*String);\r
 }\r
 \r
+/**\r
+  Validate the EFI Boot#### variable (VendorGuid/Name)\r
+\r
+  @param  Variable              Boot#### variable data.\r
+  @param  VariableSize          Returns the size of the EFI variable that was read\r
+\r
+  @retval TRUE                  The variable data is correct.\r
+  @retval FALSE                 The variable data is corrupted.\r
+\r
+**/\r
+BOOLEAN \r
+ValidateOption (\r
+  UINT8                     *Variable,\r
+  UINTN                     VariableSize\r
+  )\r
+{\r
+  UINT16                    FilePathSize;\r
+  UINT8                     *TempPtr;\r
+  EFI_DEVICE_PATH_PROTOCOL  *DevicePath;\r
+  EFI_DEVICE_PATH_PROTOCOL  *TempPath;\r
+  UINTN                     TempSize;\r
+\r
+  //\r
+  // Skip the option attribute\r
+  //\r
+  TempPtr    = Variable;\r
+  TempPtr   += sizeof (UINT32);\r
+\r
+  //\r
+  // Get the option's device path size\r
+  //\r
+  FilePathSize  = *(UINT16 *) TempPtr;\r
+  TempPtr      += sizeof (UINT16);\r
+\r
+  //\r
+  // Get the option's description string size\r
+  //\r
+  TempSize = StrSizeEx ((CHAR16 *) TempPtr, VariableSize);\r
+  TempPtr += TempSize;\r
+\r
+  //\r
+  // Get the option's device path\r
+  //\r
+  DevicePath =  (EFI_DEVICE_PATH_PROTOCOL *) TempPtr;\r
+  TempPtr    += FilePathSize;\r
+\r
+  //\r
+  // Validation boot option variable.\r
+  //\r
+  if ((FilePathSize == 0) || (TempSize == 0)) {\r
+    return FALSE;\r
+  }\r
+\r
+  if (TempSize + FilePathSize + sizeof (UINT16) + sizeof (UINT16) > VariableSize) {\r
+    return FALSE;\r
+  }\r
+\r
+  TempPath = DevicePath;\r
+  while (FilePathSize > 0) {\r
+    TempSize = GetDevicePathSizeEx (TempPath, FilePathSize);\r
+    if (TempSize == 0) {\r
+      return FALSE;\r
+    }\r
+    FilePathSize = (UINT16) (FilePathSize - TempSize);\r
+    TempPath    += TempSize;\r
+  }\r
+\r
+  return TRUE;\r
+}\r
+\r
 /**\r
   Convert a single character to number.\r
   It assumes the input Char is in the scope of L'0' ~ L'9' and L'A' ~ L'F'\r
@@ -548,6 +626,14 @@ BdsLibVariableToOption (
   if (Variable == NULL) {\r
     return NULL;\r
   }\r
+\r
+  //\r
+  // Validate Boot#### variable data.\r
+  //\r
+  if (!ValidateOption(Variable, VariableSize)) {\r
+    return NULL;\r
+  }\r
+\r
   //\r
   // Notes: careful defined the variable of Boot#### or\r
   // Driver####, consider use some macro to abstract the code\r

diff --git a/IntelFrameworkModulePkg/Library/GenericBdsLib/InternalBdsLib.h b/IntelFrameworkModulePkg/Library/GenericBdsLib/InternalBdsLib.h
index 28a6649347fcb27ea2f6553e852d4f0758f32c6f..039747df0fa880feb60df790d27c63d5f1684d3d 100644 (file)
--- a/IntelFrameworkModulePkg/Library/GenericBdsLib/InternalBdsLib.h
+++ b/IntelFrameworkModulePkg/Library/GenericBdsLib/InternalBdsLib.h
@@ -126,4 +126,20 @@ BdsSetMemoryTypeInformationVariable (
   VOID\r
   );\r
 \r
+/**\r
+  Validate the EFI Boot#### or Driver#### variable (VendorGuid/Name)\r
+\r
+  @param  Variable              Boot#### variable data.\r
+  @param  VariableSize          Returns the size of the EFI variable that was read\r
+\r
+  @retval TRUE                  The variable data is correct.\r
+  @retval FALSE                 The variable data is corrupted.\r
+\r
+**/\r
+BOOLEAN \r
+ValidateOption (\r
+  UINT8                     *Variable,\r
+  UINTN                     VariableSize\r
+  );\r
+\r
 #endif // _BDS_LIB_H_\r