OvmfPkg/TdxMeasurementLib: Bound event size before BuildGuidHob

TdxMeasurementBuildGuidHob() passes a fixed header size plus the
caller-supplied EventSize to BuildGuidHob() and then copies EventSize
bytes into the returned buffer. Where UINTN is 32 bits, that sum can wrap,
so BuildGuidHob() would allocate the wrapped length while CopyMem() still
writes EventSize bytes past the end of the HOB.

Compute the payload length with SafeUint32Add() and fail with
EFI_INVALID_PARAMETER on overflow. BuildGuidHob() enforces the maximum
GUID HOB payload and returns NULL for oversized requests, which the
existing NULL check already handles.

Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>

0 files changed, 0 insertions, 0 deletions