MdeModulePkg: Fix buffer overflow in MergeMemoryMap

Check that the next map entry is valid before dereferencing to merge the
guard pages. If the final entry is at the end of a page with no valid page
following it, then this can cause an access violation.

Signed-off-by: Kenneth Lautner <kenlautner3@gmail.com>

diff --git a/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c b/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c
index 58b947423a0eb9db2fe0ca5ba19091a193f56e8f..a11c455ab598c9b1d57db2838d23b4d939480518 100644 (file)
--- a/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c
+++ b/MdeModulePkg/Core/Dxe/Misc/MemoryAttributesTable.c
@@ -395,11 +395,14 @@ MergeMemoryMap (
   NewMemoryMapEntry = MemoryMap;\r
   MemoryMapEnd      = (EFI_MEMORY_DESCRIPTOR *)((UINT8 *)MemoryMap + *MemoryMapSize);\r
   while ((UINTN)MemoryMapEntry < (UINTN)MemoryMapEnd) {\r
-    CopyMem (NewMemoryMapEntry, MemoryMapEntry, sizeof (EFI_MEMORY_DESCRIPTOR));\r
+    CopyMem (NewMemoryMapEntry, MemoryMapEntry, DescriptorSize);\r
     NextMemoryMapEntry = NEXT_MEMORY_DESCRIPTOR (MemoryMapEntry, DescriptorSize);\r
 \r
     do {\r
-      MergeGuardPages (NewMemoryMapEntry, NextMemoryMapEntry->PhysicalStart);\r
+      if ((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) {\r
+        MergeGuardPages (NewMemoryMapEntry, NextMemoryMapEntry->PhysicalStart);\r
+      }\r
+\r
       MemoryBlockLength = LShiftU64 (NewMemoryMapEntry->NumberOfPages, EFI_PAGE_SHIFT);\r
       if (((UINTN)NextMemoryMapEntry < (UINTN)MemoryMapEnd) &&\r
           (NewMemoryMapEntry->Type == NextMemoryMapEntry->Type) &&\r