From 76c23f9e0d0d65866e4195b0bc12c1ca2763ced2 Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Mon, 7 Jan 2019 08:15:00 +0100 Subject: [PATCH] ArmPkg/ArmMmuLib AARCH64: fix out of bounds access Take care not to dereference BlockEntry if it may be pointing past the end of the page table we are manipulating. It is only a read, and thus harmless, but HeapGuard triggers on it so let's fix it. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ard Biesheuvel Reviewed-by: Leif Lindholm --- ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c index e41044142e..d66df3e17a 100644 --- a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c +++ b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c @@ -382,7 +382,7 @@ UpdateRegionMapping ( // Break the inner loop when next block is a table // Rerun GetBlockEntryListFromAddress to avoid page table memory leak - if (TableLevel != 3 && + if (TableLevel != 3 && BlockEntry <= LastBlockEntry && (*BlockEntry & TT_TYPE_MASK) == TT_TYPE_TABLE_ENTRY) { break; } -- 2.39.2