Skip to content

Commit

Permalink
Fix buffer overflow when merging guard pages in MergeMemoryMap (#126)
Browse files Browse the repository at this point in the history
## Description

Checks that the next map entry is valid before dereferencing to merge
the guard pages. If the final entry is at the end of a page with no
valid page following it, then this can cause an access violation.

## How This Was Tested

Tested on Q35 platform boot.

## Integration Instructions

N/A
  • Loading branch information
cfernald authored and kenlautner committed May 9, 2023
1 parent 85ccad8 commit ada470c
Showing 1 changed file with 8 additions and 2 deletions.
10 changes: 8 additions & 2 deletions MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c
Original file line number Diff line number Diff line change
Expand Up @@ -460,11 +460,17 @@ MergeMemoryMap (
NewMemoryMapEntry = MemoryMap;
MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *)((UINT8 *)MemoryMap + *MemoryMapSize);
while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {
CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof (EFI_MEMORY_DESCRIPTOR));
CopyMem (NewMemoryMapEntry, MemoryMapEntry, DescriptorSize); // MU_CHANGE Use size parameter for consistency.
NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);

do {
MergeGuardPages (NewMemoryMapEntry, NextMemoryMapEntry->PhysicalStart);
// MU_CHANGE START Fix overflow in the MergeGuardPages call.
if ((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) {
MergeGuardPages (NewMemoryMapEntry, NextMemoryMapEntry->PhysicalStart);
}

// MU_CHANGE END

MemoryBlockLength = (UINT64)(EfiPagesToSize (NewMemoryMapEntry->NumberOfPages));
if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&
(NewMemoryMapEntry->Type == NextMemoryMapEntry->Type) &&
Expand Down

0 comments on commit ada470c

Please sign in to comment.