On 04/07/21 18:08, Laszlo Ersek wrote: > On 04/06/21 21:52, Kun Qin wrote: >> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3283 >> >> Current SMM Save State routine does not check the number of bytes to be >> read, when it comse to read IO_INFO, before casting the incoming buffer >> to EFI_SMM_SAVE_STATE_IO_INFO. This could potentially cause memory >> corruption due to extra bytes are written out of buffer boundary. >> >> This change adds a width check before copying IoInfo into output buffer. >> >> Cc: Eric Dong <eric.d...@intel.com> >> Cc: Ray Ni <ray...@intel.com> >> Cc: Laszlo Ersek <ler...@redhat.com> >> Cc: Rahul Kumar <rahul1.ku...@intel.com> >> >> Signed-off-by: Kun Qin <kuqi...@gmail.com> >> Reviewed-by: Ray Ni <ray...@intel.com> >> Reviewed-by: Laszlo Ersek <ler...@redhat.com> >> --- >> >> Notes: >> v2: >> - Update return code description [Laszlo] >> >> UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c | 9 ++++++++- >> UefiCpuPkg/PiSmmCpuDxeSmm/PiSmmCpuDxeSmm.h | 2 +- >> 2 files changed, 9 insertions(+), 2 deletions(-) > > Thanks, looks OK. I'll let Ray or Eric merge the patch.
:/ Merged as commit a7d8e28b29f2, via <https://github.com/tianocore/edk2/pull/1554>. Laszlo -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#73972): https://edk2.groups.io/g/devel/message/73972 Mute This Topic: https://groups.io/mt/81899611/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
