<div dir="auto">Thanks!</div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 7 Nov 2022, 01:32 gaoliming via <a href="http://groups.io">groups.io</a>, <gaoliming=<a href="mailto:byosoft.com.cn@groups.io">byosoft.com.cn@groups.io</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="ZH-CN" link="blue" vlink="purple" style="word-wrap:break-word"><div class="m_-7791251494075673953WordSection1">Create <a href="https://github.com/tianocore/edk2/pull/3604" target="_blank" rel="noreferrer">https://github.com/tianocore/edk2/pull/3604</a> to merge this patch. ThanksLiming<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"><div><div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">发件人: <a href="mailto:devel@edk2.groups.io" target="_blank" rel="noreferrer">devel@edk2.groups.io</a> <<a href="mailto:devel@edk2.groups.io" target="_blank" rel="noreferrer">devel@edk2.groups.io</a>> 代表 Pedro Falcato 发送时间: 2022年11月5日 8:25 收件人: <a href="mailto:devel@edk2.groups.io" target="_blank" rel="noreferrer">devel@edk2.groups.io</a>; <a href="mailto:gaoliming@byosoft.com.cn" target="_blank" rel="noreferrer">gaoliming@byosoft.com.cn</a> 抄送: Vitaly Cheptsov <<a href="mailto:vit9696@protonmail.com" target="_blank" rel="noreferrer">vit9696@protonmail.com</a>>; Marvin Häuser <<a href="mailto:mhaeuser@posteo.de" target="_blank" rel="noreferrer">mhaeuser@posteo.de</a>>; Michael D Kinney <<a href="mailto:michael.d.kinney@intel.com" target="_blank" rel="noreferrer">michael.d.kinney@intel.com</a>>; Zhiguang Liu <<a href="mailto:zhiguang.liu@intel.com" target="_blank" rel="noreferrer">zhiguang.liu@intel.com</a>>; Jiewen Yao <<a href="mailto:Jiewen.yao@intel.com" target="_blank" rel="noreferrer">Jiewen.yao@intel.com</a>> 主题: Re: [edk2-devel] 回复: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString</div></div> <div><div>Hi Liming,</div><div> </div><div>Thank you for the review. Can we please push this in time for the stable tag?</div><div> </div><div>Thanks,</div><div>Pedro</div></div> <div><div>On Fri, Nov 4, 2022 at 1:22 AM gaoliming via <a href="http://groups.io" target="_blank" rel="noreferrer">groups.io</a> <gaoliming=<a href="mailto:byosoft.com.cn@groups.io" target="_blank" rel="noreferrer">byosoft.com.cn@groups.io</a>> wrote:</div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">Reviewed-by: Liming Gao <<a href="mailto:gaoliming@byosoft.com.cn" target="_blank" rel="noreferrer">gaoliming@byosoft.com.cn</a>> > -----邮件原件----- > 发件人: Pedro Falcato <<a href="mailto:pedro.falcato@gmail.com" target="_blank" rel="noreferrer">pedro.falcato@gmail.com</a>> > 发送时间: 2022年11月3日 9:12 > 收件人: <a href="mailto:devel@edk2.groups.io" target="_blank" rel="noreferrer">devel@edk2.groups.io</a> > 抄送: Pedro Falcato <<a href="mailto:pedro.falcato@gmail.com" target="_blank" rel="noreferrer">pedro.falcato@gmail.com</a>>; Vitaly Cheptsov > <<a href="mailto:vit9696@protonmail.com" target="_blank" rel="noreferrer">vit9696@protonmail.com</a>>; Marvin Häuser <<a href="mailto:mhaeuser@posteo.de" target="_blank" rel="noreferrer">mhaeuser@posteo.de</a>>; > Michael D Kinney <<a href="mailto:michael.d.kinney@intel.com" target="_blank" rel="noreferrer">michael.d.kinney@intel.com</a>>; Liming Gao > <<a href="mailto:gaoliming@byosoft.com.cn" target="_blank" rel="noreferrer">gaoliming@byosoft.com.cn</a>>; Zhiguang Liu <<a href="mailto:zhiguang.liu@intel.com" target="_blank" rel="noreferrer">zhiguang.liu@intel.com</a>>; Jiewen > Yao <<a href="mailto:Jiewen.yao@Intel.com" target="_blank" rel="noreferrer">Jiewen.yao@Intel.com</a>> > 主题: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString > > There was a OOB access in *StrHexTo* functions, when passed strings like > "XDEADBEEF". > > OpenCore folks established an ASAN-equipped project to fuzz Ext4Dxe, > which was able to catch these (mostly harmless) issues. > > Cc: Vitaly Cheptsov <<a href="mailto:vit9696@protonmail.com" target="_blank" rel="noreferrer">vit9696@protonmail.com</a>> > Cc: Marvin Häuser <<a href="mailto:mhaeuser@posteo.de" target="_blank" rel="noreferrer">mhaeuser@posteo.de</a>> > Cc: Michael D Kinney <<a href="mailto:michael.d.kinney@intel.com" target="_blank" rel="noreferrer">michael.d.kinney@intel.com</a>> > Cc: Liming Gao <<a href="mailto:gaoliming@byosoft.com.cn" target="_blank" rel="noreferrer">gaoliming@byosoft.com.cn</a>> > Cc: Zhiguang Liu <<a href="mailto:zhiguang.liu@intel.com" target="_blank" rel="noreferrer">zhiguang.liu@intel.com</a>> > Signed-off-by: Pedro Falcato <<a href="mailto:pedro.falcato@gmail.com" target="_blank" rel="noreferrer">pedro.falcato@gmail.com</a>> > Acked-by: Michael D Kinney <<a href="mailto:michael.d.kinney@intel.com" target="_blank" rel="noreferrer">michael.d.kinney@intel.com</a>> > Reviewed-by: Jiewen Yao <<a href="mailto:Jiewen.yao@Intel.com" target="_blank" rel="noreferrer">Jiewen.yao@Intel.com</a>> > --- > MdePkg/Library/BaseLib/SafeString.c | 25 +++++++++++++++++++++---- > 1 file changed, 21 insertions(+), 4 deletions(-) > > diff --git a/MdePkg/Library/BaseLib/SafeString.c > b/MdePkg/Library/BaseLib/SafeString.c > index f338a32a3a41..b75b33381732 100644 > --- a/MdePkg/Library/BaseLib/SafeString.c > +++ b/MdePkg/Library/BaseLib/SafeString.c > @@ -863,6 +863,9 @@ StrHexToUintnS ( > OUT UINTN *Data > ) > { > + BOOLEAN FoundLeadingZero; > + > + FoundLeadingZero = FALSE; > ASSERT (((UINTN)String & BIT0) == 0); > > // > @@ -892,12 +895,14 @@ StrHexToUintnS ( > // > // Ignore leading Zeros after the spaces > // > + > + FoundLeadingZero = *String == L'0'; > while (*String == L'0') { > String++; > } > > if (CharToUpper (*String) == L'X') { > - if (*(String - 1) != L'0') { > + if (!FoundLeadingZero) { > *Data = 0; > return RETURN_SUCCESS; > } > @@ -992,6 +997,9 @@ StrHexToUint64S ( > OUT UINT64 *Data > ) > { > + BOOLEAN FoundLeadingZero; > + > + FoundLeadingZero = FALSE; > ASSERT (((UINTN)String & BIT0) == 0); > > // > @@ -1021,12 +1029,13 @@ StrHexToUint64S ( > // > // Ignore leading Zeros after the spaces > // > + FoundLeadingZero = *String == L'0'; > while (*String == L'0') { > String++; > } > > if (CharToUpper (*String) == L'X') { > - if (*(String - 1) != L'0') { > + if (!FoundLeadingZero) { > *Data = 0; > return RETURN_SUCCESS; > } > @@ -2393,6 +2402,9 @@ AsciiStrHexToUintnS ( > OUT UINTN *Data > ) > { > + BOOLEAN FoundLeadingZero; > + > + FoundLeadingZero = FALSE; > // > // 1. Neither String nor Data shall be a null pointer. > // > @@ -2420,12 +2432,13 @@ AsciiStrHexToUintnS ( > // > // Ignore leading Zeros after the spaces > // > + FoundLeadingZero = *String == '0'; > while (*String == '0') { > String++; > } > > if (AsciiCharToUpper (*String) == 'X') { > - if (*(String - 1) != '0') { > + if (!FoundLeadingZero) { > *Data = 0; > return RETURN_SUCCESS; > } > @@ -2517,6 +2530,9 @@ AsciiStrHexToUint64S ( > OUT UINT64 *Data > ) > { > + BOOLEAN FoundLeadingZero; > + > + FoundLeadingZero = FALSE; > // > // 1. Neither String nor Data shall be a null pointer. > // > @@ -2544,12 +2560,13 @@ AsciiStrHexToUint64S ( > // > // Ignore leading Zeros after the spaces > // > + FoundLeadingZero = *String == '0'; > while (*String == '0') { > String++; > } > > if (AsciiCharToUpper (*String) == 'X') { > - if (*(String - 1) != '0') { > + if (!FoundLeadingZero) { > *Data = 0; > return RETURN_SUCCESS; > } > -- > 2.38.1 </blockquote></div> -- <div><div>Pedro Falcato</div></div><div></div></div></div></div> </blockquote></div> <div width="1" style="color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links: You receive all messages sent to this group. <a target="_blank" href="https://edk2.groups.io/g/devel/message/96023">View/Reply Online (#96023)</a> | | <a target="_blank" href="https://groups.io/mt/94861914/1813853">Mute This Topic</a> | <a href="https://edk2.groups.io/g/devel/post">New Topic</a> <a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> | <a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> | <a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a> [edk2-devel-archive@redhat.com] <div width="1" style="color:white;clear:both">_._,_._,_</div>