From 6919a3f7c77097c857f83fb980e6fd479348b1ea Mon Sep 17 00:00:00 2001
From: Gary Ching-Pang Lin <glin@suse.com>
Date: Fri, 21 Sep 2012 16:44:56 +0800
Subject: [PATCH] Make sure the variables are not broken

---
 MokManager.c | 5 ++++-
 shim.c       | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/MokManager.c b/MokManager.c
index 9025f6f..97501f6 100644
--- a/MokManager.c
+++ b/MokManager.c
@@ -101,6 +101,9 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
 	int i;
 	void *ptr;
 
+	if (DataSize < sizeof(UINT32))
+		return NULL;
+
 	list = AllocatePool(sizeof(MokListNode) * num);
 
 	if (!list) {
@@ -478,7 +481,7 @@ static EFI_STATUS check_mok_request(EFI_HANDLE image_handle)
 	efi_status = get_variable(L"MokNew", shim_lock_guid, &attributes,
 				  &MokNewSize, &MokNew);
 
-	if (efi_status != EFI_SUCCESS) {
+	if (efi_status != EFI_SUCCESS || MokNewSize < sizeof(UINT32)) {
 		goto error;
 	}
 
diff --git a/shim.c b/shim.c
index 73b2feb..95c3e54 100644
--- a/shim.c
+++ b/shim.c
@@ -107,6 +107,9 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
 	int i, remain = DataSize;
 	void *ptr;
 
+	if (DataSize < sizeof(UINT32))
+		return NULL;
+
 	list = AllocatePool(sizeof(MokListNode) * num);
 
 	if (!list) {
@@ -601,7 +604,7 @@ static EFI_STATUS verify_buffer (char *data, int datasize,
 	status = get_variable(L"MokList", shim_lock_guid, &attributes,
 			      &MokListDataSize, &MokListData);
 
-	if (status != EFI_SUCCESS) {
+	if (status != EFI_SUCCESS || MokListDataSize < sizeof(UINT32)) {
 		status = EFI_ACCESS_DENIED;
 		Print(L"Invalid signature\n");
 		goto done;