From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ivan Gorinov Date: Thu, 24 May 2018 17:09:25 -0700 Subject: [U-Boot] [PATCH] efi_selftest: check for buffer overflow in efi_get_variable Message-ID: <20180525000925.GA33845@intel.com> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Check if GetVariable writes past the end of the output data buffer. Signed-off-by: Ivan Gorinov --- lib/efi_selftest/efi_selftest_variables.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/lib/efi_selftest/efi_selftest_variables.c b/lib/efi_selftest/efi_selftest_variables.c index f5e8eb6..8a02dbc 100644 --- a/lib/efi_selftest/efi_selftest_variables.c +++ b/lib/efi_selftest/efi_selftest_variables.c @@ -72,6 +72,22 @@ static int execute(void) efi_st_error("SetVariable failed\n"); return EFI_ST_FAILURE; } + data[3] = 0xff; + len = 3; + ret = runtime->get_variable(L"efi_st_var0", &guid_vendor0, + &attr, &len, data); + if (ret != EFI_SUCCESS) { + efi_st_error("GetVariable failed\n"); + return EFI_ST_FAILURE; + } + if (efi_st_memcmp(data, v + 4, 3)) { + efi_st_error("GetVariable returned wrong value\n"); + return EFI_ST_FAILURE; + } + if (data[3] != 0xff) { + efi_st_error("GetVariable wrote past the end of the buffer\n"); + return EFI_ST_FAILURE; + } /* Set variable 1 */ ret = runtime->set_variable(L"efi_st_var1", &guid_vendor1, EFI_VARIABLE_BOOTSERVICE_ACCESS, -- 2.7.4