Merge branch 'linaro-release' of git://git.linaro.org/arm/uefi/uefi-nextlinaro-uefi-2013.04

Signed-off-by: Ryan Harkin <ryan.harkin@linaro.org>

1 files changed, 30 insertions, 0 deletions

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
index 2a59ac16f..2fca25981 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
@@ -198,6 +198,16 @@ RuntimeServiceGetVariable (
     return EFI_INVALID_PARAMETER;

   }

 

+  if (*DataSize >= mVariableBufferSize) {

+    //

+    // DataSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to

+    // overflow to a small value and pass the check in InitCommunicateBuffer().

+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if DataSize is >= mVariableBufferSize.

+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.

+    //

+    return EFI_INVALID_PARAMETER;

+  }

+

   AcquireLockOnlyAtBootTime(&mVariableServicesLock);

 

   //

@@ -275,6 +285,16 @@ RuntimeServiceGetNextVariableName (
     return EFI_INVALID_PARAMETER;

   }

 

+  if (*VariableNameSize >= mVariableBufferSize) {

+    //

+    // VariableNameSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to

+    // overflow to a small value and pass the check in InitCommunicateBuffer().

+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if VariableNameSize is >= mVariableBufferSize.

+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.

+    //

+    return EFI_INVALID_PARAMETER;

+  }

+

   AcquireLockOnlyAtBootTime(&mVariableServicesLock);

 

   //

@@ -355,6 +375,16 @@ RuntimeServiceSetVariable (
     return EFI_INVALID_PARAMETER;

   }

 

+  if (DataSize >= mVariableBufferSize) {

+    //

+    // DataSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to

+    // overflow to a small value and pass the check in InitCommunicateBuffer().

+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if DataSize is >= mVariableBufferSize.

+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.

+    //

+    return EFI_INVALID_PARAMETER;

+  }

+

   AcquireLockOnlyAtBootTime(&mVariableServicesLock);

  

   //