[PATCH 7/7] MdeModulePkg NvmExpressDxe: Add check for command packet in PassThru

[Hao Wu <hao.a.wu@intel.com>]

This commit adds check for the 'TransferBuffer' and 'TransferLength'
fields in EFI_NVM_EXPRESS_PASS_THRU_COMMAND_PACKET when the Opcode of an
NVME command indicates a data transfer between controller and host.

This commit also makes sure that the 'MetadataLength' field in
EFI_NVM_EXPRESS_PASS_THRU_COMMAND_PACKET is not 0 when the corresponding
'MetadataBuffer' field has a non-NULL value.

Cc: Feng Tian <feng.tian@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
 MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c b/MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c
index c7ead21..693418c 100644
--- a/MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c
+++ b/MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c
@@ -477,6 +477,10 @@ NvmExpressPassThru (
   // processor and a PCI Bus Master. It's caller's responsbility to ensure this.
   //
   if (((Sq->Opc & (BIT0 | BIT1)) != 0) && (Sq->Opc != NVME_ADMIN_CRIOCQ_CMD) && (Sq->Opc != NVME_ADMIN_CRIOSQ_CMD)) {
+    if ((Packet->TransferLength == 0) || (Packet->TransferBuffer == NULL)) {
+      return EFI_INVALID_PARAMETER;
+    }
+
     if ((Sq->Opc & BIT0) != 0) {
       Flag = EfiPciIoOperationBusMasterRead;
     } else {
@@ -499,8 +503,7 @@ NvmExpressPassThru (
     Sq->Prp[0] = PhyAddr;
     Sq->Prp[1] = 0;
 
-    MapLength = Packet->MetadataLength;
-    if(Packet->MetadataBuffer != NULL) {
+    if((Packet->MetadataLength != 0) && (Packet->MetadataBuffer != NULL)) {
       MapLength = Packet->MetadataLength;
       Status = PciIo->Map (
                         PciIo,
-- 
1.9.5.msysgit.0