From fda8482df707dd4f3880e5060979f8df86b86e12 Mon Sep 17 00:00:00 2001 From: Wei6 Xu Date: Thu, 27 Jun 2019 16:43:06 +0800 Subject: [PATCH] MdeModulePkg/DxeCapsuleLibFmp: Add missing NULL pointer check. Add missing NULL pointer check for CapsuleNameBufStart. Also add comments to notice that capsule name integrity check assumes the capsule has been validated by IsValidCapsuleHeader(). Cc: Jian J Wang Cc: Hao A Wu Cc: Chao B Zhang Signed-off-by: Wei6 Xu Reviewed-by: Hao A Wu Reviewed-by: Chao B Zhang --- MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c b/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c index 66c9be8e1f..3193ca8f4d 100644 --- a/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c +++ b/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c @@ -25,6 +25,9 @@ IsCapsuleNameCapsule ( Check the integrity of the capsule name capsule. If the capsule is vaild, return the physical address of each capsule name string. + This routine assumes the capsule has been validated by IsValidCapsuleHeader(), so + capsule memory overflow is not going to happen in this routine. + @param[in] CapsuleHeader Pointer to the capsule header of a capsule name capsule. @param[out] CapsuleNameNum Number of capsule name. @@ -65,6 +68,9 @@ ValidateCapsuleNameCapsuleIntegrity ( // if (((UINTN) CapsuleNameBufStart & BIT0) != 0) { CapsuleNameBufStart = AllocateCopyPool (CapsuleHeader->CapsuleImageSize - CapsuleHeader->HeaderSize, CapsuleNameBufStart); + if (CapsuleNameBufStart == NULL) { + return NULL; + } } CapsuleNameBufEnd = CapsuleNameBufStart + CapsuleHeader->CapsuleImageSize - CapsuleHeader->HeaderSize; -- 2.39.2