From: lzeng14 <lzeng14@6f19259b-4bc3-4df7-8a09-765794883524>
Date: Fri, 28 Sep 2012 02:30:25 +0000 (+0000)
Subject: Add more exact SMM check in SmmFaultTolerantWriteHandler.
X-Git-Tag: edk2-stable201903~13017
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=7ea4cf3f595f35373ff57cff997cde0bcea6871f

Add more exact SMM check in SmmFaultTolerantWriteHandler.

Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Elvin Li <elvin.li@intel.com>

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13763 6f19259b-4bc3-4df7-8a09-765794883524
---

diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
index 2537d22e2c..e7d79c1aa5 100644
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
@@ -337,9 +337,19 @@ SmmFaultTolerantWriteHandler (
   SMM_FTW_GET_LAST_WRITE_HEADER                    *SmmFtwGetLastWriteHeader;
   VOID                                             *PrivateData;
   EFI_HANDLE                                       SmmFvbHandle;
+  UINTN                                            InfoSize;
 
-  ASSERT (CommBuffer != NULL);
-  ASSERT (CommBufferSize != NULL);
+
+  //
+  // If input is invalid, stop processing this SMI
+  //
+  if (CommBuffer == NULL || CommBufferSize == NULL) {
+    return EFI_SUCCESS;
+  }
+
+  if (*CommBufferSize < SMM_FTW_COMMUNICATE_HEADER_SIZE) {
+    return EFI_SUCCESS;
+  }
 
   if (InternalIsAddressInSmram ((EFI_PHYSICAL_ADDRESS)(UINTN)CommBuffer, *CommBufferSize)) {
     DEBUG ((EFI_D_ERROR, "SMM communication buffer size is in SMRAM!\n"));
@@ -349,7 +359,18 @@ SmmFaultTolerantWriteHandler (
   SmmFtwFunctionHeader = (SMM_FTW_COMMUNICATE_FUNCTION_HEADER *)CommBuffer;
   switch (SmmFtwFunctionHeader->Function) {
     case FTW_FUNCTION_GET_MAX_BLOCK_SIZE:
-      SmmGetMaxBlockSizeHeader = (SMM_FTW_GET_MAX_BLOCK_SIZE_HEADER *) SmmFtwFunctionHeader->Data;     
+      SmmGetMaxBlockSizeHeader = (SMM_FTW_GET_MAX_BLOCK_SIZE_HEADER *) SmmFtwFunctionHeader->Data;
+      InfoSize = sizeof (SMM_FTW_GET_MAX_BLOCK_SIZE_HEADER);
+
+      //
+      // SMRAM range check already covered before
+      //
+      if (InfoSize > *CommBufferSize - SMM_FTW_COMMUNICATE_HEADER_SIZE) {
+        DEBUG ((EFI_D_ERROR, "Data size exceed communication buffer size limit!\n"));
+        Status = EFI_ACCESS_DENIED;
+        break;
+      }
+
       Status = FtwGetMaxBlockSize (
                  &mFtwDevice->FtwInstance,
                  &SmmGetMaxBlockSizeHeader->BlockSize
@@ -409,21 +430,27 @@ SmmFaultTolerantWriteHandler (
       
     case FTW_FUNCTION_GET_LAST_WRITE:
       SmmFtwGetLastWriteHeader = (SMM_FTW_GET_LAST_WRITE_HEADER *) SmmFtwFunctionHeader->Data;
-      if (((UINT8*)SmmFtwGetLastWriteHeader->Data > (UINT8*)CommBuffer) &&  
-          ((UINT8*)SmmFtwGetLastWriteHeader->Data + SmmFtwGetLastWriteHeader->PrivateDataSize <= (UINT8*)CommBuffer + (*CommBufferSize))) {
-        Status = FtwGetLastWrite (
-                   &mFtwDevice->FtwInstance,
-                   &SmmFtwGetLastWriteHeader->CallerId,
-                   &SmmFtwGetLastWriteHeader->Lba,
-                   &SmmFtwGetLastWriteHeader->Offset,
-                   &SmmFtwGetLastWriteHeader->Length,
-                   &SmmFtwGetLastWriteHeader->PrivateDataSize,
-                   (VOID *)SmmFtwGetLastWriteHeader->Data,
-                   &SmmFtwGetLastWriteHeader->Complete
-                   );
-      } else  {
-        Status = EFI_INVALID_PARAMETER;
+      InfoSize = OFFSET_OF (SMM_FTW_GET_LAST_WRITE_HEADER, Data) + SmmFtwGetLastWriteHeader->PrivateDataSize;
+
+      //
+      // SMRAM range check already covered before
+      //
+      if (InfoSize > *CommBufferSize - SMM_FTW_COMMUNICATE_HEADER_SIZE) {
+        DEBUG ((EFI_D_ERROR, "Data size exceed communication buffer size limit!\n"));
+        Status = EFI_ACCESS_DENIED;
+        break;
       }
+
+      Status = FtwGetLastWrite (
+                 &mFtwDevice->FtwInstance,
+                 &SmmFtwGetLastWriteHeader->CallerId,
+                 &SmmFtwGetLastWriteHeader->Lba,
+                 &SmmFtwGetLastWriteHeader->Offset,
+                 &SmmFtwGetLastWriteHeader->Length,
+                 &SmmFtwGetLastWriteHeader->PrivateDataSize,
+                 (VOID *)SmmFtwGetLastWriteHeader->Data,
+                 &SmmFtwGetLastWriteHeader->Complete
+                 );
       break;
 
     default: