Skip to content

Commit 35d0384

Browse files
committed
MdePkg: Fix overflow issue in BasePeCoffLib:
PeCoffLoaderRelocateImage The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is also a UINT32 value. The current code does not check for overflow when adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a check to ensure that the addition does not overflow. Signed-off-by: Doug Flick <dougflick@microsoft.com> Authored-by: sriraamx gobichettipalayam <sri..@intel.com>
1 parent 8b295e0 commit 35d0384

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

MdePkg/Library/BasePeCoffLib/BasePeCoff.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1054,7 +1054,7 @@ PeCoffLoaderRelocateImage (
10541054
RelocDir = &Hdr.Te->DataDirectory[0];
10551055
}
10561056

1057-
if ((RelocDir != NULL) && (RelocDir->Size > 0)) {
1057+
if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {
10581058
RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
10591059
RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (
10601060
ImageContext,

0 commit comments

Comments
 (0)