回复: [edk2-devel] 回复: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString
gaoliming via groups.io
gaoliming=byosoft.com.cn at groups.io
Mon Nov 7 01:32:33 UTC 2022
Create https://github.com/tianocore/edk2/pull/3604 to merge this patch.
Thanks
Liming
发件人: devel at edk2.groups.io <devel at edk2.groups.io> 代表 Pedro Falcato
发送时间: 2022年11月5日 8:25
收件人: devel at edk2.groups.io; gaoliming at byosoft.com.cn
抄送: Vitaly Cheptsov <vit9696 at protonmail.com>; Marvin Häuser <mhaeuser at posteo.de>; Michael D Kinney <michael.d.kinney at intel.com>; Zhiguang Liu <zhiguang.liu at intel.com>; Jiewen Yao <Jiewen.yao at intel.com>
主题: Re: [edk2-devel] 回复: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString
Hi Liming,
Thank you for the review. Can we please push this in time for the stable tag?
Thanks,
Pedro
On Fri, Nov 4, 2022 at 1:22 AM gaoliming via groups.io <http://groups.io> <gaoliming=byosoft.com.cn at groups.io <mailto:byosoft.com.cn at groups.io> > wrote:
Reviewed-by: Liming Gao <gaoliming at byosoft.com.cn <mailto:gaoliming at byosoft.com.cn> >
> -----邮件原件-----
> 发件人: Pedro Falcato <pedro.falcato at gmail.com <mailto:pedro.falcato at gmail.com> >
> 发送时间: 2022年11月3日 9:12
> 收件人: devel at edk2.groups.io <mailto:devel at edk2.groups.io>
> 抄送: Pedro Falcato <pedro.falcato at gmail.com <mailto:pedro.falcato at gmail.com> >; Vitaly Cheptsov
> <vit9696 at protonmail.com <mailto:vit9696 at protonmail.com> >; Marvin Häuser <mhaeuser at posteo.de <mailto:mhaeuser at posteo.de> >;
> Michael D Kinney <michael.d.kinney at intel.com <mailto:michael.d.kinney at intel.com> >; Liming Gao
> <gaoliming at byosoft.com.cn <mailto:gaoliming at byosoft.com.cn> >; Zhiguang Liu <zhiguang.liu at intel.com <mailto:zhiguang.liu at intel.com> >; Jiewen
> Yao <Jiewen.yao at Intel.com <mailto:Jiewen.yao at Intel.com> >
> 主题: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString
>
> There was a OOB access in *StrHexTo* functions, when passed strings like
> "XDEADBEEF".
>
> OpenCore folks established an ASAN-equipped project to fuzz Ext4Dxe,
> which was able to catch these (mostly harmless) issues.
>
> Cc: Vitaly Cheptsov <vit9696 at protonmail.com <mailto:vit9696 at protonmail.com> >
> Cc: Marvin Häuser <mhaeuser at posteo.de <mailto:mhaeuser at posteo.de> >
> Cc: Michael D Kinney <michael.d.kinney at intel.com <mailto:michael.d.kinney at intel.com> >
> Cc: Liming Gao <gaoliming at byosoft.com.cn <mailto:gaoliming at byosoft.com.cn> >
> Cc: Zhiguang Liu <zhiguang.liu at intel.com <mailto:zhiguang.liu at intel.com> >
> Signed-off-by: Pedro Falcato <pedro.falcato at gmail.com <mailto:pedro.falcato at gmail.com> >
> Acked-by: Michael D Kinney <michael.d.kinney at intel.com <mailto:michael.d.kinney at intel.com> >
> Reviewed-by: Jiewen Yao <Jiewen.yao at Intel.com <mailto:Jiewen.yao at Intel.com> >
> ---
> MdePkg/Library/BaseLib/SafeString.c | 25 +++++++++++++++++++++----
> 1 file changed, 21 insertions(+), 4 deletions(-)
>
> diff --git a/MdePkg/Library/BaseLib/SafeString.c
> b/MdePkg/Library/BaseLib/SafeString.c
> index f338a32a3a41..b75b33381732 100644
> --- a/MdePkg/Library/BaseLib/SafeString.c
> +++ b/MdePkg/Library/BaseLib/SafeString.c
> @@ -863,6 +863,9 @@ StrHexToUintnS (
> OUT UINTN *Data
> )
> {
> + BOOLEAN FoundLeadingZero;
> +
> + FoundLeadingZero = FALSE;
> ASSERT (((UINTN)String & BIT0) == 0);
>
> //
> @@ -892,12 +895,14 @@ StrHexToUintnS (
> //
> // Ignore leading Zeros after the spaces
> //
> +
> + FoundLeadingZero = *String == L'0';
> while (*String == L'0') {
> String++;
> }
>
> if (CharToUpper (*String) == L'X') {
> - if (*(String - 1) != L'0') {
> + if (!FoundLeadingZero) {
> *Data = 0;
> return RETURN_SUCCESS;
> }
> @@ -992,6 +997,9 @@ StrHexToUint64S (
> OUT UINT64 *Data
> )
> {
> + BOOLEAN FoundLeadingZero;
> +
> + FoundLeadingZero = FALSE;
> ASSERT (((UINTN)String & BIT0) == 0);
>
> //
> @@ -1021,12 +1029,13 @@ StrHexToUint64S (
> //
> // Ignore leading Zeros after the spaces
> //
> + FoundLeadingZero = *String == L'0';
> while (*String == L'0') {
> String++;
> }
>
> if (CharToUpper (*String) == L'X') {
> - if (*(String - 1) != L'0') {
> + if (!FoundLeadingZero) {
> *Data = 0;
> return RETURN_SUCCESS;
> }
> @@ -2393,6 +2402,9 @@ AsciiStrHexToUintnS (
> OUT UINTN *Data
> )
> {
> + BOOLEAN FoundLeadingZero;
> +
> + FoundLeadingZero = FALSE;
> //
> // 1. Neither String nor Data shall be a null pointer.
> //
> @@ -2420,12 +2432,13 @@ AsciiStrHexToUintnS (
> //
> // Ignore leading Zeros after the spaces
> //
> + FoundLeadingZero = *String == '0';
> while (*String == '0') {
> String++;
> }
>
> if (AsciiCharToUpper (*String) == 'X') {
> - if (*(String - 1) != '0') {
> + if (!FoundLeadingZero) {
> *Data = 0;
> return RETURN_SUCCESS;
> }
> @@ -2517,6 +2530,9 @@ AsciiStrHexToUint64S (
> OUT UINT64 *Data
> )
> {
> + BOOLEAN FoundLeadingZero;
> +
> + FoundLeadingZero = FALSE;
> //
> // 1. Neither String nor Data shall be a null pointer.
> //
> @@ -2544,12 +2560,13 @@ AsciiStrHexToUint64S (
> //
> // Ignore leading Zeros after the spaces
> //
> + FoundLeadingZero = *String == '0';
> while (*String == '0') {
> String++;
> }
>
> if (AsciiCharToUpper (*String) == 'X') {
> - if (*(String - 1) != '0') {
> + if (!FoundLeadingZero) {
> *Data = 0;
> return RETURN_SUCCESS;
> }
> --
> 2.38.1
--
Pedro Falcato
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#96016): https://edk2.groups.io/g/devel/message/96016
Mute This Topic: https://groups.io/mt/94857316/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/edk2-devel-archive/attachments/20221107/e29bb426/attachment-0001.htm>
More information about the edk2-devel-archive
mailing list