REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1934
0x0 MicrocodeBegin MicrocodeEntry MicrocodeEnd 0xffffffff
|--------------|---------------|---------------|---------------|
valid TotalSize
TotalSize is only valid between 0 and (MicrocodeEnd - MicrocodeEntry).
So add '(UINTN)MicrocodeEntryPoint > (MAX_ADDRESS - TotalSize)' before
'((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd' to make sure
((UINTN)MicrocodeEntryPoint + TotalSize) wouldn't overflow.
Cc: Eric Dong <eric.d...@intel.com>
Cc: Ray Ni <ray...@intel.com>
Cc: Laszlo Ersek <ler...@redhat.com>
Cc: Liming Gao <liming....@intel.com>
Signed-off-by: Zhichao Gao <zhichao....@intel.com>
---
UefiCpuPkg/Library/MpInitLib/Microcode.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/UefiCpuPkg/Library/MpInitLib/Microcode.c
b/UefiCpuPkg/Library/MpInitLib/Microcode.c
index 4763dcfebe..c30df58e5a 100644
--- a/UefiCpuPkg/Library/MpInitLib/Microcode.c
+++ b/UefiCpuPkg/Library/MpInitLib/Microcode.c
@@ -1,7 +1,7 @@
/** @file
Implementation of loading microcode on processors.
- Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2015 - 2019, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -167,9 +167,15 @@ MicrocodeDetect (
}
///
- /// Check overflow and whether TotalSize is aligned with 4 bytes.
+ /// 0x0 MicrocodeBegin MicrocodeEntry MicrocodeEnd 0xffffffff
+ /// |--------------|---------------|---------------|---------------|
+ /// valid TotalSize
+ /// TotalSize is only valid between 0 and (MicrocodeEnd - MicrocodeEntry).
+ /// And it should be aligned with 4 bytes.
+ /// If the TotalSize is invalid skip 1KB the check next entry.
///
- if ( ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd ||
+ if ( (UINTN)MicrocodeEntryPoint > (MAX_ADDRESS - TotalSize) ||
+ ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd ||
(TotalSize & 0x3) != 0
) {
MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN)
MicrocodeEntryPoint) + SIZE_1KB);
--
2.21.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#42866): https://edk2.groups.io/g/devel/message/42866
Mute This Topic: https://groups.io/mt/32212210/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
