From d76d97e341a606dc4cd0f8ce2074529fd545395a Mon Sep 17 00:00:00 2001 From: Michael Kubacki Date: Fri, 24 Jul 2026 11:04:28 -0400 Subject: [PATCH] UefiTestingPkg: Fix memory info database dump Fixes: https://github.com/microsoft/mu_plus/issues/924 Memory info is stored in `mMemoryInfoDatabaseBuffer`. The code first calculates how large of a buffer is needed. A "dry run" is performed to compute that. It calls each dump handler with `AllowAllocation=FALSE`, to get the size of the data that would be written. However, the call to `LoadedImageTableDump()` during this phase, seets `AllowAllocation=TRUE`. `mMemoryInfoDatabaseOffset` is still `NULL`, then `AppendMemoryInfoDatabase()` sees that and allocates a buffer. Now, `mMemoryInfoDatabaseSize` is advanced. Other dump handlers after write to the buffer now that it exists. Eventually, `DumpPagingInfo()` allocates the real (intended) buffer. Because of what happened earlier, the "accidental" buffer is leaked and `mMemoryInfoDatabaseSize` is non-zero which causes `mMemoryInfoDatabaseBuffer[mMemoryInfoDatabaseSize]` to write past the beginning of the buffer: ```c // Copy the new string to the end of the buffer and update the size. if (!EFI_ERROR (Status)) { CopyMem (&mMemoryInfoDatabaseBuffer[mMemoryInfoDatabaseSize], DatabaseString, NewStringSize); mMemoryInfoDatabaseSize = NewDatabaseSize; } ``` This change sets `AllowAllocation=FALSE` in that call and resets `mMemoryInfoDatabaseSize` to zero before the real allocation as a precaution. Signed-off-by: Michael Kubacki --- .../AuditTests/PagingAudit/UEFI/PagingAuditCommon.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/UefiTestingPkg/AuditTests/PagingAudit/UEFI/PagingAuditCommon.c b/UefiTestingPkg/AuditTests/PagingAudit/UEFI/PagingAuditCommon.c index 14514ea5b4..9cb38f638a 100644 --- a/UefiTestingPkg/AuditTests/PagingAudit/UEFI/PagingAuditCommon.c +++ b/UefiTestingPkg/AuditTests/PagingAudit/UEFI/PagingAuditCommon.c @@ -1606,7 +1606,7 @@ DumpPagingInfo ( StringLength = 0; // Calculate the string size of the Loaded Image Table - Status = LoadedImageTableDump (TRUE, &StringLength); + Status = LoadedImageTableDump (FALSE, &StringLength); if (EFI_ERROR (Status) && (Status != EFI_NOT_STARTED)) { DEBUG ((DEBUG_ERROR, "%a - Error tabulating required string size for the loaded image info in the memory info database\n", __func__)); @@ -1650,6 +1650,9 @@ DumpPagingInfo ( goto Cleanup; } + // Prevent a stale, non-zero offset from writing past the beginning of the buffer. + mMemoryInfoDatabaseSize = 0; + if (mPteCounts[EntryGuard] > 0) { // Calculate the string size of the guard page entries Status = GuardPageDump (mPteEntries[EntryGuard], mPteCounts[EntryGuard], TRUE);