Re: [PATCH v1 1/1] UefiCpuPkg: PiSmmCpuDxeSmm: Check buffer size before accessing

Kun Qin

Hi Laszlo,

Thanks for the feedback. I will update the description in v2.


On 04/06/2021 05:09, Laszlo Ersek wrote:
On 03/27/21 00:41, Kun Qin wrote:

Current SMM Save State routine does not check the number of bytes to be
read, when it comse to read IO_INFO, before casting the incoming buffer
to EFI_SMM_SAVE_STATE_IO_INFO. This could potentially cause memory
corruption due to extra bytes are written out of buffer boundary.

This change adds a width check before copying IoInfo into output buffer.

Cc: Eric Dong <>
Cc: Ray Ni <>
Cc: Laszlo Ersek <>
Cc: Rahul Kumar <>

Signed-off-by: Kun Qin <>
UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
index 661cc51f361a..ec760e4c37ca 100644
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
@@ -418,6 +418,13 @@ ReadSaveStateRegister (
+ //
+ // Make sure the incoming buffer is large enough to hold IoInfo before accessing
+ //
+ if (Width < sizeof (EFI_SMM_SAVE_STATE_IO_INFO)) {
+ }
// Zero the IoInfo structure that will be returned in Buffer
Please update the description of the EFI_INVALID_PARAMETER return code
in the function's leading comment as well.
With that:
Reviewed-by: Laszlo Ersek <>

Join to automatically receive all group messages.