[U-Boot] [PATCH 2/6] efi_loader: Fix memory map size check to avoid out-of-bounds access

[Brüns, Stefan]

On Freitag, 30. September 2016 14:25:40 CEST Alexander Graf wrote:
> On 30.09.16 02:03, Stefan Brüns wrote:
> > memory_map_size as IN parameter specifies the size of the provided buffer.
> > If the buffer is to small, memory_map_size is updated to indicate the
> > required size, and an error code is returned.
> > 
> > Signed-off-by: Stefan Brüns <stefan.bruens at rwth-aachen.de>
> 
> This patch doesn't actually change anything, does it?

It does ...

> 
> Alex
> 
> > ---
> > 
> >  lib/efi_loader/efi_memory.c | 8 +++++---
> >  1 file changed, 5 insertions(+), 3 deletions(-)
> > 
> > diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c
> > index ebe8e94..5d71fdf 100644
> > --- a/lib/efi_loader/efi_memory.c
> > +++ b/lib/efi_loader/efi_memory.c
> > @@ -342,16 +342,18 @@ efi_status_t efi_get_memory_map(unsigned long
> > *memory_map_size,> 
> >  	map_size = map_entries * sizeof(struct efi_mem_desc);
> > 
> > -	*memory_map_size = map_size;

The caller provided buffer size was changed here

> > -
> > 
> >  	if (descriptor_size)
> >  	
> >  		*descriptor_size = sizeof(struct efi_mem_desc);
> >  	
> >  	if (descriptor_version)
> >  	
> >  		*descriptor_version = EFI_MEMORY_DESCRIPTOR_VERSION;
> > 
> > -	if (*memory_map_size < map_size)

-> this check was always false

> > +	if (*memory_map_size < map_size) {
> > +		*memory_map_size = map_size;
> > 
> >  		return EFI_BUFFER_TOO_SMALL;
> > 
> > +	}
> > +
> > +	*memory_map_size = map_size;
> > 
> >  	/* Copy list into array */
> >  	if (memory_map) {