Skip to content

Commit 2cff874

Browse files
PaddyDengKClgao4
authored andcommitted
MdeModulePkg/Spi: Solving potential null ptr deref. in SpiNorFlashJedecSfdp
The pointer `Instance->SfdpBasicFlash` can be used before initializing. Example code flow: - CreateSpiNorFlashSfdpInstance: Allocate pool for `Instance` - InitialSpiNorFlashSfdpInstance - ReadSfdp - ReadSfdpHeader - FillWriteBuffer: Dereferencing `Instance->SfdpBasicFlash` - ReadSfdpBasicParameterTable: Allocate pool for `Instance->SfdpBasicFlash` Check both `Instance` and `Instance->SfdpBasicFlash` should have a non null value before dereferencing it. Otherwise use the defaut value 0. Also terminate the function if `Instance` or `WriteBuffer` is NULL. Signed-off-by: Paddy Deng <v-paddydeng@microsoft.com>
1 parent 02ec228 commit 2cff874

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

MdeModulePkg/Bus/Spi/SpiNorFlashJedecSfdp/SpiNorFlash.c

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,17 @@ FillWriteBuffer (
4848
UINT32 Index;
4949
UINT8 SfdpAddressBytes;
5050

51-
SfdpAddressBytes = (UINT8)Instance->SfdpBasicFlash->AddressBytes;
51+
if ((Instance == NULL) || (WriteBuffer == NULL)) {
52+
ASSERT (Instance != NULL);
53+
ASSERT (WriteBuffer != NULL);
54+
return 0;
55+
}
56+
57+
if (Instance->SfdpBasicFlash == NULL) {
58+
SfdpAddressBytes = 0;
59+
} else {
60+
SfdpAddressBytes = (UINT8)Instance->SfdpBasicFlash->AddressBytes;
61+
}
5262

5363
// Copy Opcode into Write Buffer
5464
Instance->SpiTransactionWriteBuffer[0] = Opcode;

0 commit comments

Comments
 (0)