From 964c22b8ea3b1c497fed0547f29e8338be26040a Mon Sep 17 00:00:00 2001 From: Ken Lautner Date: Wed, 28 Aug 2024 10:55:09 -0700 Subject: MdeModulePkg: Fix buffer overflow in MergeMemoryMap Check that the next map entry is valid before dereferencing to merge the guard pages. If the final entry is at the end of a page with no valid page following it, then this can cause an access violation. Signed-off-by: Kenneth Lautner --- MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'MdeModulePkg') diff --git a/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c b/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c index 58b947423a..a11c455ab5 100644 --- a/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c +++ b/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c @@ -395,11 +395,14 @@ MergeMemoryMap ( NewMemoryMapEntry = MemoryMap; MemoryMapEnd = (EFI_MEMORY_DESCRIPTOR *)((UINT8 *)MemoryMap + *MemoryMapSize); while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) { - CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof (EFI_MEMORY_DESCRIPTOR)); + CopyMem (NewMemoryMapEntry, MemoryMapEntry, DescriptorSize); NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize); do { - MergeGuardPages (NewMemoryMapEntry, NextMemoryMapEntry->PhysicalStart); + if ((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) { + MergeGuardPages (NewMemoryMapEntry, NextMemoryMapEntry->PhysicalStart); + } + MemoryBlockLength = LShiftU64 (NewMemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT); if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) && (NewMemoryMapEntry->Type == NextMemoryMapEntry->Type) && -- cgit