Merge branch 'linaro-tracking-2013.04' into linaro-releaselinaro-uefi-2013.04

Conflicts:
	PandaBoardPkg/Include/PandaBoard.h
	PandaBoardPkg/Library/PandaBoardLib/Clock.c
	PandaBoardPkg/Library/PandaBoardLib/PadConfiguration.c

Signed-off-by: Ryan Harkin <ryan.harkin@linaro.org>

2 files changed, 35 insertions, 0 deletions

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
index 8f10425ebb..956c1f2ae1 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
@@ -2756,6 +2756,11 @@ VariableCommonInitialize (
   ASSERT(VariableStoreHeader->Size == VariableStoreLength);

     

   //

+  // The max variable or hardware error variable size should be < variable store size.

+  //

+  ASSERT(MAX (PcdGet32 (PcdMaxVariableSize), PcdGet32 (PcdMaxHardwareErrorVariableSize)) < VariableStoreLength);

+

+  //

   // Parse non-volatile variable data and get last variable offset.

   //

   NextVariable  = GetStartPointer ((VARIABLE_STORE_HEADER *)(UINTN)VariableStoreBase);

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
index 2a59ac16f9..2fca25981a 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
@@ -198,6 +198,16 @@ RuntimeServiceGetVariable (
     return EFI_INVALID_PARAMETER;

   }

 

+  if (*DataSize >= mVariableBufferSize) {

+    //

+    // DataSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to

+    // overflow to a small value and pass the check in InitCommunicateBuffer().

+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if DataSize is >= mVariableBufferSize.

+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.

+    //

+    return EFI_INVALID_PARAMETER;

+  }

+

   AcquireLockOnlyAtBootTime(&mVariableServicesLock);

 

   //

@@ -275,6 +285,16 @@ RuntimeServiceGetNextVariableName (
     return EFI_INVALID_PARAMETER;

   }

 

+  if (*VariableNameSize >= mVariableBufferSize) {

+    //

+    // VariableNameSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to

+    // overflow to a small value and pass the check in InitCommunicateBuffer().

+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if VariableNameSize is >= mVariableBufferSize.

+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.

+    //

+    return EFI_INVALID_PARAMETER;

+  }

+

   AcquireLockOnlyAtBootTime(&mVariableServicesLock);

 

   //

@@ -355,6 +375,16 @@ RuntimeServiceSetVariable (
     return EFI_INVALID_PARAMETER;

   }

 

+  if (DataSize >= mVariableBufferSize) {

+    //

+    // DataSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to

+    // overflow to a small value and pass the check in InitCommunicateBuffer().

+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if DataSize is >= mVariableBufferSize.

+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.

+    //

+    return EFI_INVALID_PARAMETER;

+  }

+

   AcquireLockOnlyAtBootTime(&mVariableServicesLock);

  

   //