Skip to content

Commit

Permalink
MdePkg: Fix overflow issue in BasePeCoffLib
Browse files Browse the repository at this point in the history
The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is
also a UINT32 value. The current code does not check for overflow when
adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a
check to ensure that the addition does not overflow.

Signed-off-by: Doug Flick <[email protected]>
Authored-by: sriraamx gobichettipalayam <[email protected]>
  • Loading branch information
Flickdm authored and mergify[bot] committed Sep 30, 2024
1 parent 517019a commit c95233b
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion MdePkg/Library/BasePeCoffLib/BasePeCoff.c
Original file line number Diff line number Diff line change
Expand Up @@ -1054,7 +1054,7 @@ PeCoffLoaderRelocateImage (
RelocDir = &Hdr.Te->DataDirectory[0];
}

if ((RelocDir != NULL) && (RelocDir->Size > 0)) {
if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {
RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (
ImageContext,
Expand Down

0 comments on commit c95233b

Please sign in to comment.