commit d5aef955b917e1afc2a76b68f91154aa77e0e12c
author Star Zeng <star.zeng@intel.com> Thu Dec 08 18:16:05 2016 +0800
committer Star Zeng <star.zeng@intel.com> Mon Dec 12 09:55:37 2016 +0800
tree 0141be64feb972afb06bd0fb315508cf242bb11b
parent 62016c1e898434a0326f658912b1e7e0a9c5575e

MdeModulePkg VariableSmm: Check InfoSize correctly

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=290

Current SmmVariableGetStatistics() in VariableSmm.c is always
checking input InfoSize against the first variable info,
it is incorrect.

For instance, there are three variables.
BootOrder
Boot0000
Boot0001

If the input InfoEntry is holding the second variable info (Boot0000)
and InfoSize is sizeof (VARIABLE_INFO_ENTRY) + StrSize (L"Boot0000"),
current code will return EFI_BUFFER_TOO_SMALL, but it should return
the third variable info (Boot0001).

This patch is to refine the code logic.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
index c714916..2184634 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
@@ -349,9 +349,10 @@
   )

 {

   VARIABLE_INFO_ENTRY                                  *VariableInfo;

-  UINTN                                                NameLength;

+  UINTN                                                NameSize;

   UINTN                                                StatisticsInfoSize;

   CHAR16                                               *InfoName;

+  UINTN                                                InfoNameMaxSize;

   EFI_GUID                                             VendorGuid;

 

   if (InfoEntry == NULL) {

@@ -363,12 +364,13 @@
     return EFI_UNSUPPORTED;

   }

 

-  StatisticsInfoSize = sizeof (VARIABLE_INFO_ENTRY) + StrSize (VariableInfo->Name);

+  StatisticsInfoSize = sizeof (VARIABLE_INFO_ENTRY);

   if (*InfoSize < StatisticsInfoSize) {

     *InfoSize = StatisticsInfoSize;

     return EFI_BUFFER_TOO_SMALL;

   }

   InfoName = (CHAR16 *)(InfoEntry + 1);

+  InfoNameMaxSize = (*InfoSize - sizeof (VARIABLE_INFO_ENTRY));

 

   CopyGuid (&VendorGuid, &InfoEntry->VendorGuid);

 

@@ -376,8 +378,14 @@
     //

     // Return the first variable info

     //

+    NameSize = StrSize (VariableInfo->Name);

+    StatisticsInfoSize = sizeof (VARIABLE_INFO_ENTRY) + NameSize;

+    if (*InfoSize < StatisticsInfoSize) {

+      *InfoSize = StatisticsInfoSize;

+      return EFI_BUFFER_TOO_SMALL;

+    }

     CopyMem (InfoEntry, VariableInfo, sizeof (VARIABLE_INFO_ENTRY));

-    CopyMem (InfoName, VariableInfo->Name, StrSize (VariableInfo->Name));

+    CopyMem (InfoName, VariableInfo->Name, NameSize);

     *InfoSize = StatisticsInfoSize;

     return EFI_SUCCESS;

   }

@@ -387,9 +395,9 @@
   //

   while (VariableInfo != NULL) {

     if (CompareGuid (&VariableInfo->VendorGuid, &VendorGuid)) {

-      NameLength = StrSize (VariableInfo->Name);

-      if (NameLength == StrSize (InfoName)) {

-        if (CompareMem (VariableInfo->Name, InfoName, NameLength) == 0) {

+      NameSize = StrSize (VariableInfo->Name);

+      if (NameSize <= InfoNameMaxSize) {

+        if (CompareMem (VariableInfo->Name, InfoName, NameSize) == 0) {

           //

           // Find the match one

           //

@@ -409,14 +417,15 @@
   //

   // Output the new variable info

   //

-  StatisticsInfoSize = sizeof (VARIABLE_INFO_ENTRY) + StrSize (VariableInfo->Name);

+  NameSize = StrSize (VariableInfo->Name);

+  StatisticsInfoSize = sizeof (VARIABLE_INFO_ENTRY) + NameSize;

   if (*InfoSize < StatisticsInfoSize) {

     *InfoSize = StatisticsInfoSize;

     return EFI_BUFFER_TOO_SMALL;

   }

 

   CopyMem (InfoEntry, VariableInfo, sizeof (VARIABLE_INFO_ENTRY));

-  CopyMem (InfoName, VariableInfo->Name, StrSize (VariableInfo->Name));

+  CopyMem (InfoName, VariableInfo->Name, NameSize);

   *InfoSize = StatisticsInfoSize;

 

   return EFI_SUCCESS;