diff --git a/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.c b/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.c index 25491d71d2..522981eb18 100644 --- a/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.c +++ b/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.c @@ -61,6 +61,7 @@ Communicate ( EFI_HOB_GUID_TYPE *GuidHob; MM_COMM_BUFFER *MmCommBuffer; MM_COMM_BUFFER_STATUS *MmCommBufferStatus; + UINTN MaxBufferSize; DEBUG ((DEBUG_INFO, "StandaloneMmIpl Communicate Enter\n")); @@ -92,8 +93,14 @@ Communicate ( } } - if (TempCommSize > EFI_PAGES_TO_SIZE (MmCommBuffer->NumberOfPages)) { - DEBUG ((DEBUG_ERROR, "Communicate buffer size (%d) is over MAX (%d) size!", TempCommSize, EFI_PAGES_TO_SIZE (MmCommBuffer->NumberOfPages))); + Status = SafeUintnMult (MmCommBuffer->NumberOfPages, EFI_PAGE_SIZE, &MaxBufferSize); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Overflow occurred while calculating MaxBufferSize!\n")); + return EFI_INVALID_PARAMETER; + } + + if (TempCommSize > MaxBufferSize) { + DEBUG ((DEBUG_ERROR, "Communicate buffer size (%d) is over MAX (%d) size!", TempCommSize, MaxBufferSize)); return EFI_INVALID_PARAMETER; } @@ -119,7 +126,17 @@ Communicate ( // // Return status from software SMI // - *CommSize = (UINTN)MmCommBufferStatus->ReturnBufferSize; + Status = SafeUint64ToUintn (MmCommBufferStatus->ReturnBufferSize, CommSize); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Overflow occurred while converting ReturnBufferSize to CommSize!\n")); + return EFI_BAD_BUFFER_SIZE; + } + + if (*CommSize > TempCommSize) { + DEBUG ((DEBUG_ERROR, "Returned buffer size is larger than the Communication Buffer, TempCommSize: 0x%llx, ReturnBufferSize: 0x%llx\n", TempCommSize, *CommSize)); + ASSERT (*CommSize <= TempCommSize); + return EFI_BAD_BUFFER_SIZE; + } // // Copy the returned data to the non-mmram buffer (CommBuffer) @@ -157,12 +174,13 @@ Communicate3 ( EFI_STATUS Status; EFI_PEI_MM_CONTROL_PPI *MmControl; UINT8 SmiCommand; - UINTN Size; - UINTN TempCommSize; + UINT64 Size; + UINT64 TempCommSize; EFI_HOB_GUID_TYPE *GuidHob; MM_COMM_BUFFER *MmCommBuffer; MM_COMM_BUFFER_STATUS *MmCommBufferStatus; EFI_MM_COMMUNICATE_HEADER_V3 *CommunicateHeader; + UINT64 MaxBufferSize; DEBUG ((DEBUG_INFO, "StandaloneMmIpl Communicate Enter\n")); @@ -204,8 +222,14 @@ Communicate3 ( } } - if (TempCommSize > EFI_PAGES_TO_SIZE (MmCommBuffer->NumberOfPages)) { - DEBUG ((DEBUG_ERROR, "Communicate buffer size (%d) is over MAX (%d) size!", TempCommSize, EFI_PAGES_TO_SIZE (MmCommBuffer->NumberOfPages))); + Status = SafeUint64Mult (MmCommBuffer->NumberOfPages, EFI_PAGE_SIZE, &MaxBufferSize); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_ERROR, "Overflow occurred while calculating MaxBufferSize!\n")); + return EFI_INVALID_PARAMETER; + } + + if (TempCommSize > MaxBufferSize) { + DEBUG ((DEBUG_ERROR, "Communicate buffer size (%d) is over MAX (%d) size!", TempCommSize, MaxBufferSize)); return EFI_INVALID_PARAMETER; } @@ -231,7 +255,13 @@ Communicate3 ( // // Return status from software SMI // - TempCommSize = (UINTN)MmCommBufferStatus->ReturnBufferSize; + if (MmCommBufferStatus->ReturnBufferSize > TempCommSize) { + DEBUG ((DEBUG_ERROR, "Returned buffer size is larger than the Communication Buffer, TempCommSize: 0x%llx, ReturnBufferSize: 0x%llx\n", TempCommSize, MmCommBufferStatus->ReturnBufferSize)); + ASSERT (MmCommBufferStatus->ReturnBufferSize <= TempCommSize); + return EFI_BAD_BUFFER_SIZE; + } + + TempCommSize = MmCommBufferStatus->ReturnBufferSize; // // Copy the returned data to the non-mmram buffer (CommBuffer) diff --git a/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.h b/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.h index b82363e26f..03a3425e29 100644 --- a/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.h +++ b/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.h @@ -27,6 +27,7 @@ #include #include #include +#include /** Communicates with a registered handler. diff --git a/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.inf b/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.inf index c06899e8ae..ffb3ca767a 100644 --- a/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.inf +++ b/StandaloneMmPkg/Drivers/StandaloneMmIplPei/StandaloneMmIplPei.inf @@ -44,6 +44,7 @@ PeCoffLib CacheMaintenanceLib MmPlatformHobProducerLib + SafeIntLib [Guids] gMmCommBufferHobGuid