[edk2-devel] [PATCH v2 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString
Pedro Falcato
pedro.falcato at gmail.com
Thu Nov 3 01:13:57 UTC 2022
Hi Liming,
I've just sent out the v3.
Thanks,
Pedro
On Thu, Nov 3, 2022 at 1:01 AM gaoliming <gaoliming at byosoft.com.cn> wrote:
> Pedro:
>
> Marvin gave one suggestion for the code change (
> https://edk2.groups.io/g/devel/message/95635). Can you response it?
>
>
>
> Thanks
>
> Liming
>
> *发件人:* Pedro Falcato <pedro.falcato at gmail.com>
> *发送时间:* 2022年11月3日 7:42
> *收件人:* Kinney, Michael D <michael.d.kinney at intel.com>
> *抄送:* Yao, Jiewen <jiewen.yao at intel.com>; devel at edk2.groups.io; Vitaly
> Cheptsov <vit9696 at protonmail.com>; Marvin Häuser <mhaeuser at posteo.de>;
> Gao, Liming <gaoliming at byosoft.com.cn>; Liu, Zhiguang <
> zhiguang.liu at intel.com>
> *主题:* Re: [PATCH v2 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in
> SafeString
>
>
>
> Can someone push this? Is there a blocker here?
>
>
>
> On Wed, Oct 26, 2022 at 4:54 PM Kinney, Michael D <
> michael.d.kinney at intel.com> wrote:
>
> Acked-by: Michael D Kinney <michael.d.kinney at intel.com>
>
>
> > -----Original Message-----
> > From: Yao, Jiewen <jiewen.yao at intel.com>
> > Sent: Wednesday, October 26, 2022 6:35 AM
> > To: Kinney, Michael D <michael.d.kinney at intel.com>; Pedro Falcato <
> pedro.falcato at gmail.com>; devel at edk2.groups.io
> > Cc: Vitaly Cheptsov <vit9696 at protonmail.com>; Marvin Häuser <
> mhaeuser at posteo.de>; Gao, Liming <gaoliming at byosoft.com.cn>; Liu,
> > Zhiguang <zhiguang.liu at intel.com>
> > Subject: RE: [PATCH v2 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in
> SafeString
> >
> > That is good catch.
> >
> > Reviewed-by: Jiewen Yao <Jiewen.yao at Intel.com>
> >
> >
> > > -----Original Message-----
> > > From: Kinney, Michael D <michael.d.kinney at intel.com>
> > > Sent: Wednesday, October 26, 2022 12:23 AM
> > > To: Pedro Falcato <pedro.falcato at gmail.com>; devel at edk2.groups.io
> > > Cc: Vitaly Cheptsov <vit9696 at protonmail.com>; Marvin Häuser
> > > <mhaeuser at posteo.de>; Gao, Liming <gaoliming at byosoft.com.cn>; Liu,
> > > Zhiguang <zhiguang.liu at intel.com>; Yao, Jiewen <jiewen.yao at intel.com>
> > > Subject: RE: [PATCH v2 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in
> > > SafeString
> > >
> > > Adding Jiewen Yao.
> > >
> > > Mike
> > >
> > > > -----Original Message-----
> > > > From: Pedro Falcato <pedro.falcato at gmail.com>
> > > > Sent: Monday, October 24, 2022 3:43 PM
> > > > To: devel at edk2.groups.io
> > > > Cc: Pedro Falcato <pedro.falcato at gmail.com>; Vitaly Cheptsov
> > > <vit9696 at protonmail.com>; Marvin Häuser <mhaeuser at posteo.de>;
> > > > Kinney, Michael D <michael.d.kinney at intel.com>; Gao, Liming
> > > <gaoliming at byosoft.com.cn>; Liu, Zhiguang <zhiguang.liu at intel.com>
> > > > Subject: [PATCH v2 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in
> > > SafeString
> > > >
> > > > OpenCore folks established an ASAN-equipped project to fuzz Ext4Dxe,
> > > > which was able to catch these (mostly harmless) issues.
> > > >
> > > > Signed-off-by: Pedro Falcato <pedro.falcato at gmail.com>
> > > > Cc: Vitaly Cheptsov <vit9696 at protonmail.com>
> > > > Cc: Marvin Häuser <mhaeuser at posteo.de>
> > > > Cc: Michael D Kinney <michael.d.kinney at intel.com>
> > > > Cc: Liming Gao <gaoliming at byosoft.com.cn>
> > > > Cc: Zhiguang Liu <zhiguang.liu at intel.com>
> > > > ---
> > > > MdePkg/Library/BaseLib/SafeString.c | 24 ++++++++++++++++++++----
> > > > 1 file changed, 20 insertions(+), 4 deletions(-)
> > > >
> > > > diff --git a/MdePkg/Library/BaseLib/SafeString.c
> > > b/MdePkg/Library/BaseLib/SafeString.c
> > > > index f338a32a3a41..77a2585ad56d 100644
> > > > --- a/MdePkg/Library/BaseLib/SafeString.c
> > > > +++ b/MdePkg/Library/BaseLib/SafeString.c
> > > > @@ -863,6 +863,9 @@ StrHexToUintnS (
> > > > OUT UINTN *Data
> > > > )
> > > > {
> > > > + BOOLEAN FoundLeadingZero;
> > > > +
> > > > + FoundLeadingZero = FALSE;
> > > > ASSERT (((UINTN)String & BIT0) == 0);
> > > >
> > > > //
> > > > @@ -893,11 +896,12 @@ StrHexToUintnS (
> > > > // Ignore leading Zeros after the spaces
> > > > //
> > > > while (*String == L'0') {
> > > > + FoundLeadingZero = TRUE;
> > > > String++;
> > > > }
> > > >
> > > > if (CharToUpper (*String) == L'X') {
> > > > - if (*(String - 1) != L'0') {
> > > > + if (!FoundLeadingZero) {
> > > > *Data = 0;
> > > > return RETURN_SUCCESS;
> > > > }
> > > > @@ -992,6 +996,9 @@ StrHexToUint64S (
> > > > OUT UINT64 *Data
> > > > )
> > > > {
> > > > + BOOLEAN FoundLeadingZero;
> > > > +
> > > > + FoundLeadingZero = FALSE;
> > > > ASSERT (((UINTN)String & BIT0) == 0);
> > > >
> > > > //
> > > > @@ -1022,11 +1029,12 @@ StrHexToUint64S (
> > > > // Ignore leading Zeros after the spaces
> > > > //
> > > > while (*String == L'0') {
> > > > + FoundLeadingZero = TRUE;
> > > > String++;
> > > > }
> > > >
> > > > if (CharToUpper (*String) == L'X') {
> > > > - if (*(String - 1) != L'0') {
> > > > + if (!FoundLeadingZero) {
> > > > *Data = 0;
> > > > return RETURN_SUCCESS;
> > > > }
> > > > @@ -2393,6 +2401,9 @@ AsciiStrHexToUintnS (
> > > > OUT UINTN *Data
> > > > )
> > > > {
> > > > + BOOLEAN FoundLeadingZero;
> > > > +
> > > > + FoundLeadingZero = FALSE;
> > > > //
> > > > // 1. Neither String nor Data shall be a null pointer.
> > > > //
> > > > @@ -2421,11 +2432,12 @@ AsciiStrHexToUintnS (
> > > > // Ignore leading Zeros after the spaces
> > > > //
> > > > while (*String == '0') {
> > > > + FoundLeadingZero = TRUE;
> > > > String++;
> > > > }
> > > >
> > > > if (AsciiCharToUpper (*String) == 'X') {
> > > > - if (*(String - 1) != '0') {
> > > > + if (!FoundLeadingZero) {
> > > > *Data = 0;
> > > > return RETURN_SUCCESS;
> > > > }
> > > > @@ -2517,6 +2529,9 @@ AsciiStrHexToUint64S (
> > > > OUT UINT64 *Data
> > > > )
> > > > {
> > > > + BOOLEAN FoundLeadingZero;
> > > > +
> > > > + FoundLeadingZero = FALSE;
> > > > //
> > > > // 1. Neither String nor Data shall be a null pointer.
> > > > //
> > > > @@ -2545,11 +2560,12 @@ AsciiStrHexToUint64S (
> > > > // Ignore leading Zeros after the spaces
> > > > //
> > > > while (*String == '0') {
> > > > + FoundLeadingZero = TRUE;
> > > > String++;
> > > > }
> > > >
> > > > if (AsciiCharToUpper (*String) == 'X') {
> > > > - if (*(String - 1) != '0') {
> > > > + if (!FoundLeadingZero) {
> > > > *Data = 0;
> > > > return RETURN_SUCCESS;
> > > > }
> > > > --
> > > > 2.38.1
>
>
>
> --
>
> Pedro Falcato
>
--
Pedro Falcato
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#95878): https://edk2.groups.io/g/devel/message/95878
Mute This Topic: https://groups.io/mt/94748448/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/edk2-devel-archive/attachments/20221103/052e9a7b/attachment-0001.htm>
More information about the edk2-devel-archive
mailing list