From: Eric Dong <eric.dong@intel.com>
Date: Wed, 12 Oct 2016 12:34:05 +0000 (+0800)
Subject: MdePkg UefiDevicePathLibDevicePathProtocol: Validate before use.
X-Git-Tag: edk2-stable201903~5594
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=d9c2c9540a95608bc1179b88be90373fb93664a8

MdePkg UefiDevicePathLibDevicePathProtocol: Validate before use.

In IsDevicePathValid API, code should validate the device path
buffer not exceed the input MaxSize before reference the path
info.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
---

diff --git a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
index 5cc4b35fe4..48724160d4 100644
--- a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
+++ b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
@@ -2,7 +2,7 @@
   Library instance that implement UEFI Device Path Library class based on protocol
   gEfiDevicePathUtilitiesProtocolGuid.
 
-  Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -103,25 +103,35 @@ IsDevicePathValid (
 
   ASSERT (DevicePath != NULL);
 
-  for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {
+  if (MaxSize == 0){
+    MaxSize = MAX_UINTN;
+  }
+
+  Size = 0;
+  Count = 0;
+
+  while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) &&
+        (MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) &&
+        !IsDevicePathEnd (DevicePath)) {
     NodeLength = DevicePathNodeLength (DevicePath);
     if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {
       return FALSE;
     }
 
-    if (MaxSize > 0) {
-      Size += NodeLength;
-      if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {
-        return FALSE;
-      }
+    if (NodeLength > MAX_UINTN - Size) {
+      return FALSE;
     }
 
+    Size += NodeLength;
+
     if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {
       Count++;
       if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) {
         return FALSE;
       }
     }
+
+    DevicePath = NextDevicePathNode (DevicePath);
   }
 
   //