MdeModulePkg/Core: Fix potential array overflow

In the method DumpGuardedMemoryBitmap() and SetAllGuardPages(), the code
didn't check if the global mMapLevel is legal value or not, which leaves
a logic hole causing potential array overflow in code followed.

This patch adds sanity check before any array reference in those methods.

Cc: Wu Hao <hao.a.wu@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Wu Hao <hao.a.wu@intel.com>

diff --git a/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c b/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
index 30a73fc04d15ffbfc64a4395a622845c524d4fb6..3a829854af5eb7f7ebaa57aa81aca23536a657df 100644 (file)
--- a/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
+++ b/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
@@ -1110,7 +1110,9 @@ DumpGuardedMemoryBitmap (
   CHAR8     *Ruler1;\r
   CHAR8     *Ruler2;\r
 \r
   CHAR8     *Ruler1;\r
   CHAR8     *Ruler2;\r
 \r

-  if (mGuardedMemoryMap == 0) {\r
+  if (mGuardedMemoryMap == 0 ||\r
+      mMapLevel == 0 ||\r
+      mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {\r

     return;\r
   }\r
 \r
     return;\r
   }\r
 \r

diff --git a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
index 7dbbf79dc0106993988046e5718bf5f617906019..1d5fb8cdb5a0409cc34b618d3363ea3f7b183196 100644 (file)
--- a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
+++ b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
@@ -1170,7 +1170,9 @@ SetAllGuardPages (
   UINTN     Index;\r
   BOOLEAN   OnGuarding;\r
 \r
   UINTN     Index;\r
   BOOLEAN   OnGuarding;\r
 \r

-  if (mGuardedMemoryMap == 0) {\r
+  if (mGuardedMemoryMap == 0 ||\r
+      mMapLevel == 0 ||\r
+      mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {\r

     return;\r
   }\r
 \r
     return;\r
   }\r
 \r


@@ -1329,7 +1331,9 @@ DumpGuardedMemoryBitmap (
   CHAR8     *Ruler1;\r
   CHAR8     *Ruler2;\r
 \r
   CHAR8     *Ruler1;\r
   CHAR8     *Ruler2;\r
 \r

-  if (mGuardedMemoryMap == 0) {\r
+  if (mGuardedMemoryMap == 0 ||\r
+      mMapLevel == 0 ||\r
+      mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {\r

     return;\r
   }\r
 \r
     return;\r
   }\r
 \r