ShellPkg: BcfgDisplayDump(): enforce minimum size for Boot#### and co.

"3.1.1 Boot Manager Programming" in the UEFI 2.5 spec mandates that
Boot#### and similar options contain EFI_LOAD_OPTION structures. The
EFI_LOAD_OPTION structure encodes the fixed initial part of the payload,
and we can (and should) use it to enforce a minimum size for variable
contents.

This patch is meant as a safety improvement.

Cc: Jaben Carsey <jaben.carsey@intel.com>
Cc: Ryan Harkin <ryan.harkin@linaro.org>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19710 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c
index 36d04d495c69c29b5f6fb3f6de3e06ff9f2a0023..9955c9e64027ded272083c8390b8a6307669e724 100644 (file)
--- a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c
+++ b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c
@@ -1052,6 +1052,7 @@ BcfgDisplayDump(
   CHAR16          *DevPathString;\r
   VOID            *DevPath;\r
   UINTN           Errors;\r
   CHAR16          *DevPathString;\r
   VOID            *DevPath;\r
   UINTN           Errors;\r

+  EFI_LOAD_OPTION *LoadOption;\r

 \r
   if (OrderCount == 0) {\r
     ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_BCFG_NONE), gShellBcfgHiiHandle, L"bcfg");  \r
 \r
   if (OrderCount == 0) {\r
     ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_BCFG_NONE), gShellBcfgHiiHandle, L"bcfg");  \r


@@ -1090,6 +1091,24 @@ BcfgDisplayDump(
       goto Cleanup;\r
     }\r
 \r
       goto Cleanup;\r
     }\r
 \r

+    //\r
+    // We expect the Attributes, FilePathListLength, and L'\0'-terminated\r
+    // Description fields to be present.\r
+    //\r
+    if (BufferSize < sizeof *LoadOption + sizeof (CHAR16)) {\r
+      ShellPrintHiiEx (\r
+        -1,\r
+        -1,\r
+        NULL,\r
+        STRING_TOKEN (STR_BCFG_VAR_CORRUPT),\r
+        gShellBcfgHiiHandle,\r
+        L"bcfg",\r
+        VariableName\r
+        );\r
+      ++Errors;\r
+      goto Cleanup;\r
+    }\r
+\r

     if ((*(UINT16*)(Buffer+4)) != 0) {\r
       DevPath = AllocateZeroPool(*(UINT16*)(Buffer+4));\r
       if (DevPath != NULL) {\r
     if ((*(UINT16*)(Buffer+4)) != 0) {\r
       DevPath = AllocateZeroPool(*(UINT16*)(Buffer+4));\r
       if (DevPath != NULL) {\r

diff --git a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni
index 25bd138b2b88c3033c25394d6b858dbd17567698..282494b2f45b039d456d13ea449edb8c23f1df20 100644 (file)
--- a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni
+++ b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni
@@ -37,6 +37,7 @@
 #string STR_GEN_OUT_MEM           #language en-US "%H%s%N: Memory allocation was not successful.\r\n"\r
 #string STR_BCFG_WRITE_FAIL       #language en-US "%H%s%N: Unable to write to '%H%s%N'\r\n"\r
 #string STR_BCFG_READ_FAIL        #language en-US "%H%s%N: Unable to read from '%H%s%N'\r\n"\r
 #string STR_GEN_OUT_MEM           #language en-US "%H%s%N: Memory allocation was not successful.\r\n"\r
 #string STR_BCFG_WRITE_FAIL       #language en-US "%H%s%N: Unable to write to '%H%s%N'\r\n"\r
 #string STR_BCFG_READ_FAIL        #language en-US "%H%s%N: Unable to read from '%H%s%N'\r\n"\r

+#string STR_BCFG_VAR_CORRUPT      #language en-US "%H%s%N: Variable '%H%s%N' corrupt.\r\n"\r

 #string STR_BCFG_HANDLE           #language en-US "%H%s%N: The handle [%H%02x%N] does not have DevicePath.\r\n"\r
 #string STR_BCFG_FILE             #language en-US "%H%s%N: The file '%H%s%N' matches multiple files.\r\n"\r
 #string STR_BCFG_FILE_OPEN        #language en-US "%H%s%N: The file '%H%s%N' did not open.\r\n"\r
 #string STR_BCFG_HANDLE           #language en-US "%H%s%N: The handle [%H%02x%N] does not have DevicePath.\r\n"\r
 #string STR_BCFG_FILE             #language en-US "%H%s%N: The file '%H%s%N' matches multiple files.\r\n"\r
 #string STR_BCFG_FILE_OPEN        #language en-US "%H%s%N: The file '%H%s%N' did not open.\r\n"\r