Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Gao, Liming <liming.gao@intel.com>
Reviewed-by: Zeng, Star <star.zeng@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15393
6f19259b-4bc3-4df7-8a09-
765794883524
4. It save all the mapping info in NV variables which will be consumed\r
by platform override protocol driver to publish the platform override protocol.\r
\r
4. It save all the mapping info in NV variables which will be consumed\r
by platform override protocol driver to publish the platform override protocol.\r
\r
-Copyright (c) 2007 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
EFI_CALLBACK_INFO *Private;\r
UINT16 KeyValue;\r
PLAT_OVER_MNGR_DATA *FakeNvData;\r
EFI_CALLBACK_INFO *Private;\r
UINT16 KeyValue;\r
PLAT_OVER_MNGR_DATA *FakeNvData;\r
\r
if (Configuration == NULL || Progress == NULL) {\r
return EFI_INVALID_PARAMETER;\r
\r
if (Configuration == NULL || Progress == NULL) {\r
return EFI_INVALID_PARAMETER;\r
return EFI_SUCCESS;\r
}\r
\r
return EFI_SUCCESS;\r
}\r
\r
+ Status = EFI_SUCCESS;\r
if (mCurrentPage == FORM_ID_DRIVER) {\r
KeyValue = KEY_VALUE_DRIVER_GOTO_ORDER;\r
UpdatePrioritySelectPage (Private, KeyValue, FakeNvData);\r
KeyValue = KEY_VALUE_ORDER_SAVE_AND_EXIT;\r
if (mCurrentPage == FORM_ID_DRIVER) {\r
KeyValue = KEY_VALUE_DRIVER_GOTO_ORDER;\r
UpdatePrioritySelectPage (Private, KeyValue, FakeNvData);\r
KeyValue = KEY_VALUE_ORDER_SAVE_AND_EXIT;\r
- CommintChanges (Private, KeyValue, FakeNvData);\r
+ Status = CommintChanges (Private, KeyValue, FakeNvData);\r
//\r
// Since UpdatePrioritySelectPage will change mCurrentPage,\r
// should ensure the mCurrentPage still indicate the second page here\r
//\r
// Since UpdatePrioritySelectPage will change mCurrentPage,\r
// should ensure the mCurrentPage still indicate the second page here\r
\r
if (mCurrentPage == FORM_ID_ORDER) {\r
KeyValue = KEY_VALUE_ORDER_SAVE_AND_EXIT;\r
\r
if (mCurrentPage == FORM_ID_ORDER) {\r
KeyValue = KEY_VALUE_ORDER_SAVE_AND_EXIT;\r
- CommintChanges (Private, KeyValue, FakeNvData);\r
+ Status = CommintChanges (Private, KeyValue, FakeNvData);\r
/** @file\r
Implementation of the shared functions to do the platform driver vverride mapping.\r
\r
/** @file\r
Implementation of the shared functions to do the platform driver vverride mapping.\r
\r
- Copyright (c) 2007 - 2009, Intel Corporation. All rights reserved.<BR>\r
+ Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution. The full text of the license may be found at\r
//\r
VariableNum = 1;\r
Corrupted = FALSE;\r
//\r
VariableNum = 1;\r
Corrupted = FALSE;\r
do {\r
VariableIndex = VariableBuffer;\r
do {\r
VariableIndex = VariableBuffer;\r
- //\r
- // End flag\r
- //\r
- NotEnd = *(UINT32*) VariableIndex;\r
+ if (VariableIndex + sizeof (UINT32) > (UINT8 *) VariableBuffer + BufferSize) {\r
+ Corrupted = TRUE;\r
+ } else {\r
+ //\r
+ // End flag\r
+ //\r
+ NotEnd = *(UINT32*) VariableIndex;\r
+ }\r
//\r
// Traverse the entries containing the mapping that Controller Device Path\r
// to a set of Driver Device Paths within this variable.\r
//\r
// Traverse the entries containing the mapping that Controller Device Path\r
// to a set of Driver Device Paths within this variable.\r
//\r
// Check signature of this entry\r
//\r
//\r
// Check signature of this entry\r
//\r
+ if (VariableIndex + sizeof (UINT32) > (UINT8 *) VariableBuffer + BufferSize) {\r
+ Corrupted = TRUE;\r
+ break;\r
+ }\r
Signature = *(UINT32 *) VariableIndex;\r
if (Signature != PLATFORM_OVERRIDE_ITEM_SIGNATURE) {\r
Corrupted = TRUE;\r
Signature = *(UINT32 *) VariableIndex;\r
if (Signature != PLATFORM_OVERRIDE_ITEM_SIGNATURE) {\r
Corrupted = TRUE;\r
//\r
// Get DriverNum\r
//\r
//\r
// Get DriverNum\r
//\r
+ if (VariableIndex + sizeof (UINT32) >= (UINT8 *) VariableBuffer + BufferSize) {\r
+ Corrupted = TRUE;\r
+ break;\r
+ }\r
DriverNumber = *(UINT32*) VariableIndex;\r
OverrideItem->DriverInfoNum = DriverNumber;\r
VariableIndex = VariableIndex + sizeof (UINT32);\r
DriverNumber = *(UINT32*) VariableIndex;\r
OverrideItem->DriverInfoNum = DriverNumber;\r
VariableIndex = VariableIndex + sizeof (UINT32);\r
// Align the VariableIndex since the controller device path may not be aligned, refer to the SaveOverridesMapping()\r
//\r
VariableIndex += ((sizeof(UINT32) - ((UINTN) (VariableIndex))) & (sizeof(UINT32) - 1));\r
// Align the VariableIndex since the controller device path may not be aligned, refer to the SaveOverridesMapping()\r
//\r
VariableIndex += ((sizeof(UINT32) - ((UINTN) (VariableIndex))) & (sizeof(UINT32) - 1));\r
+ //\r
+ // Check buffer overflow.\r
+ //\r
+ if ((OverrideItem->ControllerDevicePath == NULL) || (VariableIndex < (UINT8 *) ControllerDevicePath) || \r
+ (VariableIndex > (UINT8 *) VariableBuffer + BufferSize)) {\r
+ Corrupted = TRUE;\r
+ break;\r
+ }\r
\r
//\r
// Get all DriverImageDevicePath[]\r
\r
//\r
// Get all DriverImageDevicePath[]\r
VariableIndex += ((sizeof(UINT32) - ((UINTN) (VariableIndex))) & (sizeof(UINT32) - 1));\r
\r
InsertTailList (&OverrideItem->DriverInfoList, &DriverImageInfo->Link);\r
VariableIndex += ((sizeof(UINT32) - ((UINTN) (VariableIndex))) & (sizeof(UINT32) - 1));\r
\r
InsertTailList (&OverrideItem->DriverInfoList, &DriverImageInfo->Link);\r
+\r
+ //\r
+ // Check buffer overflow\r
+ //\r
+ if ((DriverImageInfo->DriverImagePath == NULL) || (VariableIndex < (UINT8 *) DriverDevicePath) || \r
+ (VariableIndex < (UINT8 *) VariableBuffer + BufferSize)) {\r
+ Corrupted = TRUE;\r
+ break;\r
+ }\r
}\r
InsertTailList (MappingDataBase, &OverrideItem->Link);\r
}\r
InsertTailList (MappingDataBase, &OverrideItem->Link);\r
+ if (Corrupted) {\r
+ break;\r
+ }\r
}\r
\r
FreePool (VariableBuffer);\r
}\r
\r
FreePool (VariableBuffer);\r
//\r
// Check NotEnd to get all PlatDriOverX variable(s)\r
//\r
//\r
// Check NotEnd to get all PlatDriOverX variable(s)\r
//\r
- while ((*(UINT32*)VariableBuffer) != 0) {\r
+ while ((VariableBuffer != NULL) && ((*(UINT32*)VariableBuffer) != 0)) {\r
+ FreePool (VariableBuffer);\r
UnicodeSPrint (OverrideVariableName, sizeof (OverrideVariableName), L"PlatDriOver%d", VariableNum);\r
VariableBuffer = GetVariableAndSize (OverrideVariableName, &gEfiCallerIdGuid, &BufferSize);\r
VariableNum++;\r
UnicodeSPrint (OverrideVariableName, sizeof (OverrideVariableName), L"PlatDriOver%d", VariableNum);\r
VariableBuffer = GetVariableAndSize (OverrideVariableName, &gEfiCallerIdGuid, &BufferSize);\r
VariableNum++;\r
- ASSERT (VariableBuffer != NULL);\r
VariableNeededSize,\r
VariableBuffer\r
);\r
VariableNeededSize,\r
VariableBuffer\r
);\r
- ASSERT (!EFI_ERROR(Status));\r
+ FreePool (VariableBuffer);\r
+\r
+ if (EFI_ERROR (Status)) {\r
+ if (NumIndex > 0) {\r
+ //\r
+ // Delete all PlatDriOver variables when full mapping can't be set. \r
+ //\r
+ DeleteOverridesVariables ();\r
+ }\r
+ return Status;\r
+ }\r
- FreePool (VariableBuffer);\r
}\r
\r
return EFI_SUCCESS;\r
}\r
\r
return EFI_SUCCESS;\r