[PATCH v2 0/5] patches for some warnings raised by "RH covscan"

[PATCH v2 0/5] patches for some warnings raised by "RH covscan"

[Laszlo Ersek]

Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
Repo:     https://github.com/lersek/edk2.git
Branch:   covscan_bz_1710_v2

Patch-level updates relative to v1 have been noted on the patches
themselves. And earlier I described the changes to the series's
structure at <https://edk2.groups.io/g/devel/message/39301>.

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Bob Feng <bob.c.feng@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>

Thanks
Laszlo

Laszlo Ersek (5):
  MdePkg/PiFirmwareFile: express IS_SECTION2 in terms of SECTION_SIZE
  MdePkg/PiFirmwareFile: fix undefined behavior in SECTION_SIZE
  BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE
  MdePkg/PiFirmwareFile: fix undefined behavior in FFS_FILE_SIZE
  OvmfPkg/Sec: fix out-of-bounds reads

 BaseTools/Source/C/Include/Common/PiFirmwareFile.h | 11 +++++++--
 MdePkg/Include/Pi/PiFirmwareFile.h                 | 26 +++++++++++++++-----
 OvmfPkg/Sec/SecMain.c                              |  6 ++---
 3 files changed, 32 insertions(+), 11 deletions(-)

-- 
2.19.1.3.g30247aa5d201

[PATCH v2 1/5] MdePkg/PiFirmwareFile: express IS_SECTION2 in terms of SECTION_SIZE

[Laszlo Ersek]

The IS_SECTION2() function-like macro duplicates the SECTION_SIZE()
calculation, just to compare the computed size against 0xFFFFFF. Invoke
SECTION_SIZE() instead; only preserve the comparison.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---

Notes:
    v2:
    
    - pick up Ard's A-b
    
    - pick up Phil's R-b

 MdePkg/Include/Pi/PiFirmwareFile.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/MdePkg/Include/Pi/PiFirmwareFile.h b/MdePkg/Include/Pi/PiFirmwareFile.h
index 56efabcba3ec..a9f3bcc4eb8e 100644
--- a/MdePkg/Include/Pi/PiFirmwareFile.h
+++ b/MdePkg/Include/Pi/PiFirmwareFile.h
@@ -480,12 +480,12 @@ typedef struct {
   CHAR16                        VersionString[1];
 } EFI_VERSION_SECTION2;
 
-#define IS_SECTION2(SectionHeaderPtr) \
-    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) (UINTN) SectionHeaderPtr)->Size) & 0x00ffffff) == 0x00ffffff)
-
 #define SECTION_SIZE(SectionHeaderPtr) \
     ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) (UINTN) SectionHeaderPtr)->Size) & 0x00ffffff))
 
+#define IS_SECTION2(SectionHeaderPtr) \
+    (SECTION_SIZE (SectionHeaderPtr) == 0x00ffffff)
+
 #define SECTION2_SIZE(SectionHeaderPtr) \
     (((EFI_COMMON_SECTION_HEADER2 *) (UINTN) SectionHeaderPtr)->ExtendedSize)
 
-- 
2.19.1.3.g30247aa5d201

[PATCH v2 2/5] MdePkg/PiFirmwareFile: fix undefined behavior in SECTION_SIZE

[Laszlo Ersek]

RH covscan justifiedly reports that accessing
"EFI_COMMON_SECTION_HEADER.Size", which is of type UINT8[3], through a
(UINT32*), is undefined behavior:

> Error: OVERRUN (CWE-119):
> edk2-89910a39dcfd/OvmfPkg/Sec/SecMain.c:178: overrun-local: Overrunning
> array of 3 bytes at byte offset 3 by dereferencing pointer
> "(UINT32 *)((EFI_COMMON_SECTION_HEADER *)(UINTN)Section)->Size".
> #  176|       Section = (EFI_COMMON_SECTION_HEADER*)(UINTN) CurrentAddress;
> #  177|
> #  178|->     Size = SECTION_SIZE (Section);
> #  179|       if (Size < sizeof (*Section)) {
> #  180|         return EFI_VOLUME_CORRUPTED;

Fix this by accessing the array elements individually.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
Issue: scan-1007.txt
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---

Notes:
    v2:
    
    - replace EFI_COMMON_SECTION_HEADER_UNION with individual array element
      access [Jordan, Phil, Mike]

 MdePkg/Include/Pi/PiFirmwareFile.h | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/MdePkg/Include/Pi/PiFirmwareFile.h b/MdePkg/Include/Pi/PiFirmwareFile.h
index a9f3bcc4eb8e..05470538de42 100644
--- a/MdePkg/Include/Pi/PiFirmwareFile.h
+++ b/MdePkg/Include/Pi/PiFirmwareFile.h
@@ -480,8 +480,15 @@ typedef struct {
   CHAR16                        VersionString[1];
 } EFI_VERSION_SECTION2;
 
-#define SECTION_SIZE(SectionHeaderPtr) \
-    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) (UINTN) SectionHeaderPtr)->Size) & 0x00ffffff))
+///
+/// The argument passed as the SectionHeaderPtr parameter to the SECTION_SIZE()
+/// and IS_SECTION2() function-like macros below must not have side effects:
+/// SectionHeaderPtr is evaluated multiple times.
+///
+#define SECTION_SIZE(SectionHeaderPtr) ((UINT32) ( \
+    (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[0]      ) | \
+    (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[1] <<  8) | \
+    (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[2] << 16)))
 
 #define IS_SECTION2(SectionHeaderPtr) \
     (SECTION_SIZE (SectionHeaderPtr) == 0x00ffffff)
-- 
2.19.1.3.g30247aa5d201

Re: [edk2-devel] [PATCH v2 2/5] MdePkg/PiFirmwareFile: fix undefined behavior in SECTION_SIZE

[Philippe Mathieu-Daudé]

On 4/18/19 7:47 PM, Laszlo Ersek wrote:
> RH covscan justifiedly reports that accessing
> "EFI_COMMON_SECTION_HEADER.Size", which is of type UINT8[3], through a
> (UINT32*), is undefined behavior:
> 
>> Error: OVERRUN (CWE-119):
>> edk2-89910a39dcfd/OvmfPkg/Sec/SecMain.c:178: overrun-local: Overrunning
>> array of 3 bytes at byte offset 3 by dereferencing pointer
>> "(UINT32 *)((EFI_COMMON_SECTION_HEADER *)(UINTN)Section)->Size".
>> #  176|       Section = (EFI_COMMON_SECTION_HEADER*)(UINTN) CurrentAddress;
>> #  177|
>> #  178|->     Size = SECTION_SIZE (Section);
>> #  179|       if (Size < sizeof (*Section)) {
>> #  180|         return EFI_VOLUME_CORRUPTED;
> 
> Fix this by accessing the array elements individually.
> 
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
> Issue: scan-1007.txt
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
> 
> Notes:
>     v2:
>     
>     - replace EFI_COMMON_SECTION_HEADER_UNION with individual array element
>       access [Jordan, Phil, Mike]
> 
>  MdePkg/Include/Pi/PiFirmwareFile.h | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/MdePkg/Include/Pi/PiFirmwareFile.h b/MdePkg/Include/Pi/PiFirmwareFile.h
> index a9f3bcc4eb8e..05470538de42 100644
> --- a/MdePkg/Include/Pi/PiFirmwareFile.h
> +++ b/MdePkg/Include/Pi/PiFirmwareFile.h
> @@ -480,8 +480,15 @@ typedef struct {
>    CHAR16                        VersionString[1];
>  } EFI_VERSION_SECTION2;
>  
> -#define SECTION_SIZE(SectionHeaderPtr) \
> -    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) (UINTN) SectionHeaderPtr)->Size) & 0x00ffffff))
> +///
> +/// The argument passed as the SectionHeaderPtr parameter to the SECTION_SIZE()
> +/// and IS_SECTION2() function-like macros below must not have side effects:
> +/// SectionHeaderPtr is evaluated multiple times.
> +///
> +#define SECTION_SIZE(SectionHeaderPtr) ((UINT32) ( \
> +    (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[0]      ) | \
> +    (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[1] <<  8) | \
> +    (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[2] << 16)))
>  
>  #define IS_SECTION2(SectionHeaderPtr) \
>      (SECTION_SIZE (SectionHeaderPtr) == 0x00ffffff)
> 

Thanks!

Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>

[PATCH v2 3/5] BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE

[Laszlo Ersek]

Sync SECTION_SIZE() from MdePkg to BaseTools, from an earlier patch in
this series.

Cc: Bob Feng <bob.c.feng@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---

Notes:
    v2:
    
    - sync with the v2 MdePkg/PiFirmwareFile SECTION_SIZE patch

 BaseTools/Source/C/Include/Common/PiFirmwareFile.h | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
index 5bc871df4855..7d8acb669b69 100644
--- a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
+++ b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
@@ -300,8 +300,15 @@ typedef struct {
   CHAR16                      VersionString[1];
 } EFI_VERSION_SECTION2;
 
-#define SECTION_SIZE(SectionHeaderPtr) \
-    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) SectionHeaderPtr)->Size) & 0x00ffffff))
+//
+// The argument passed as the SectionHeaderPtr parameter to the SECTION_SIZE()
+// function-like macro below must not have side effects: SectionHeaderPtr is
+// evaluated multiple times.
+//
+#define SECTION_SIZE(SectionHeaderPtr) ((UINT32) ( \
+    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[0]      ) | \
+    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[1] <<  8) | \
+    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[2] << 16)))
 
 #pragma pack()
 
-- 
2.19.1.3.g30247aa5d201

Re: [edk2-devel] [PATCH v2 3/5] BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE

[Philippe Mathieu-Daudé]

On 4/18/19 7:47 PM, Laszlo Ersek wrote:
> Sync SECTION_SIZE() from MdePkg to BaseTools, from an earlier patch in
> this series.
> 
> Cc: Bob Feng <bob.c.feng@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Yonghong Zhu <yonghong.zhu@intel.com>
> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
> 
> Notes:
>     v2:
>     
>     - sync with the v2 MdePkg/PiFirmwareFile SECTION_SIZE patch
> 
>  BaseTools/Source/C/Include/Common/PiFirmwareFile.h | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> index 5bc871df4855..7d8acb669b69 100644
> --- a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> +++ b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> @@ -300,8 +300,15 @@ typedef struct {
>    CHAR16                      VersionString[1];
>  } EFI_VERSION_SECTION2;
>  
> -#define SECTION_SIZE(SectionHeaderPtr) \
> -    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) SectionHeaderPtr)->Size) & 0x00ffffff))
> +//
> +// The argument passed as the SectionHeaderPtr parameter to the SECTION_SIZE()
> +// function-like macro below must not have side effects: SectionHeaderPtr is
> +// evaluated multiple times.
> +//
> +#define SECTION_SIZE(SectionHeaderPtr) ((UINT32) ( \
> +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[0]      ) | \
> +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[1] <<  8) | \
> +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[2] << 16)))
>  
>  #pragma pack()
>  
> 

Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>

Re: [edk2-devel] [PATCH v2 3/5] BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE

[Laszlo Ersek]

Bob, Liming, Yonghong,

On 04/18/19 19:47, Laszlo Ersek wrote:
> Sync SECTION_SIZE() from MdePkg to BaseTools, from an earlier patch in
> this series.
> 
> Cc: Bob Feng <bob.c.feng@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Yonghong Zhu <yonghong.zhu@intel.com>
> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
> 
> Notes:
>     v2:
>     
>     - sync with the v2 MdePkg/PiFirmwareFile SECTION_SIZE patch
> 
>  BaseTools/Source/C/Include/Common/PiFirmwareFile.h | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)

can one of you please review this patch?

Thanks
Laszlo

> diff --git a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> index 5bc871df4855..7d8acb669b69 100644
> --- a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> +++ b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> @@ -300,8 +300,15 @@ typedef struct {
>    CHAR16                      VersionString[1];
>  } EFI_VERSION_SECTION2;
>  
> -#define SECTION_SIZE(SectionHeaderPtr) \
> -    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) SectionHeaderPtr)->Size) & 0x00ffffff))
> +//
> +// The argument passed as the SectionHeaderPtr parameter to the SECTION_SIZE()
> +// function-like macro below must not have side effects: SectionHeaderPtr is
> +// evaluated multiple times.
> +//
> +#define SECTION_SIZE(SectionHeaderPtr) ((UINT32) ( \
> +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[0]      ) | \
> +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[1] <<  8) | \
> +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[2] << 16)))
>  
>  #pragma pack()
>  
> 

Re: [edk2-devel] [PATCH v2 3/5] BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE

[Liming Gao]

Reviewed-by: Liming Gao <liming.gao@intel.com>

Sorry for the missing. 

> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com]
> Sent: Tuesday, April 23, 2019 6:31 PM
> To: Feng, Bob C <bob.c.feng@intel.com>; Gao, Liming <liming.gao@intel.com>; Zhu, Yonghong <yonghong.zhu@intel.com>
> Cc: edk2-devel-groups-io <devel@edk2.groups.io>
> Subject: Re: [edk2-devel] [PATCH v2 3/5] BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE
> 
> Bob, Liming, Yonghong,
> 
> On 04/18/19 19:47, Laszlo Ersek wrote:
> > Sync SECTION_SIZE() from MdePkg to BaseTools, from an earlier patch in
> > this series.
> >
> > Cc: Bob Feng <bob.c.feng@intel.com>
> > Cc: Liming Gao <liming.gao@intel.com>
> > Cc: Yonghong Zhu <yonghong.zhu@intel.com>
> > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
> > Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> > ---
> >
> > Notes:
> >     v2:
> >
> >     - sync with the v2 MdePkg/PiFirmwareFile SECTION_SIZE patch
> >
> >  BaseTools/Source/C/Include/Common/PiFirmwareFile.h | 11 +++++++++--
> >  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> can one of you please review this patch?
> 
> Thanks
> Laszlo
> 
> > diff --git a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> > index 5bc871df4855..7d8acb669b69 100644
> > --- a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> > +++ b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
> > @@ -300,8 +300,15 @@ typedef struct {
> >    CHAR16                      VersionString[1];
> >  } EFI_VERSION_SECTION2;
> >
> > -#define SECTION_SIZE(SectionHeaderPtr) \
> > -    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) SectionHeaderPtr)->Size) & 0x00ffffff))
> > +//
> > +// The argument passed as the SectionHeaderPtr parameter to the SECTION_SIZE()
> > +// function-like macro below must not have side effects: SectionHeaderPtr is
> > +// evaluated multiple times.
> > +//
> > +#define SECTION_SIZE(SectionHeaderPtr) ((UINT32) ( \
> > +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[0]      ) | \
> > +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[1] <<  8) | \
> > +    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[2] << 16)))
> >
> >  #pragma pack()
> >
> >

Re: [edk2-devel] [PATCH v2 3/5] BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE

[Bob Feng]

Reviewed-by: Bob Feng <bob.c.feng@intel.com>

-----Original Message-----
From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Laszlo Ersek
Sent: Friday, April 19, 2019 1:47 AM
To: edk2-devel-groups-io <devel@edk2.groups.io>
Cc: Feng, Bob C <bob.c.feng@intel.com>; Gao, Liming <liming.gao@intel.com>; Zhu, Yonghong <yonghong.zhu@intel.com>
Subject: [edk2-devel] [PATCH v2 3/5] BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE

Sync SECTION_SIZE() from MdePkg to BaseTools, from an earlier patch in this series.

Cc: Bob Feng <bob.c.feng@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---

Notes:
    v2:
    
    - sync with the v2 MdePkg/PiFirmwareFile SECTION_SIZE patch

 BaseTools/Source/C/Include/Common/PiFirmwareFile.h | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
index 5bc871df4855..7d8acb669b69 100644
--- a/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
+++ b/BaseTools/Source/C/Include/Common/PiFirmwareFile.h
@@ -300,8 +300,15 @@ typedef struct {
   CHAR16                      VersionString[1];
 } EFI_VERSION_SECTION2;
 
-#define SECTION_SIZE(SectionHeaderPtr) \
-    ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) SectionHeaderPtr)->Size) & 0x00ffffff))
+//
+// The argument passed as the SectionHeaderPtr parameter to the 
+SECTION_SIZE() // function-like macro below must not have side effects: 
+SectionHeaderPtr is // evaluated multiple times.
+//
+#define SECTION_SIZE(SectionHeaderPtr) ((UINT32) ( \
+    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[0]      ) | \
+    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[1] <<  8) | \
+    (((EFI_COMMON_SECTION_HEADER *) (SectionHeaderPtr))->Size[2] << 
+16)))
 
 #pragma pack()
 
--
2.19.1.3.g30247aa5d201



-=-=-=-=-=-=
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#39309): https://edk2.groups.io/g/devel/message/39309
Mute This Topic: https://groups.io/mt/31233851/1768742
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [bob.c.feng@intel.com]
-=-=-=-=-=-=

[PATCH v2 4/5] MdePkg/PiFirmwareFile: fix undefined behavior in FFS_FILE_SIZE

[Laszlo Ersek]

Accessing "EFI_FFS_FILE_HEADER.Size", which is of type UINT8[3], through a
(UINT32*), is undefined behavior. Fix it by accessing the array elements
individually.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---

Notes:
    v2:
    
    - eliminate intermediate macros [Mike]

 MdePkg/Include/Pi/PiFirmwareFile.h | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/MdePkg/Include/Pi/PiFirmwareFile.h b/MdePkg/Include/Pi/PiFirmwareFile.h
index 05470538de42..ec7729e9c36e 100644
--- a/MdePkg/Include/Pi/PiFirmwareFile.h
+++ b/MdePkg/Include/Pi/PiFirmwareFile.h
@@ -179,8 +179,15 @@ typedef struct {
 #define IS_FFS_FILE2(FfsFileHeaderPtr) \
     (((((EFI_FFS_FILE_HEADER *) (UINTN) FfsFileHeaderPtr)->Attributes) & FFS_ATTRIB_LARGE_FILE) == FFS_ATTRIB_LARGE_FILE)
 
-#define FFS_FILE_SIZE(FfsFileHeaderPtr) \
-    ((UINT32) (*((UINT32 *) ((EFI_FFS_FILE_HEADER *) (UINTN) FfsFileHeaderPtr)->Size) & 0x00ffffff))
+///
+/// The argument passed as the FfsFileHeaderPtr parameter to the
+/// FFS_FILE_SIZE() function-like macro below must not have side effects:
+/// FfsFileHeaderPtr is evaluated multiple times.
+///
+#define FFS_FILE_SIZE(FfsFileHeaderPtr) ((UINT32) ( \
+    (((EFI_FFS_FILE_HEADER *) (UINTN) (FfsFileHeaderPtr))->Size[0]      ) | \
+    (((EFI_FFS_FILE_HEADER *) (UINTN) (FfsFileHeaderPtr))->Size[1] <<  8) | \
+    (((EFI_FFS_FILE_HEADER *) (UINTN) (FfsFileHeaderPtr))->Size[2] << 16)))
 
 #define FFS_FILE2_SIZE(FfsFileHeaderPtr) \
     ((UINT32) (((EFI_FFS_FILE_HEADER2 *) (UINTN) FfsFileHeaderPtr)->ExtendedSize))
-- 
2.19.1.3.g30247aa5d201

Re: [edk2-devel] [PATCH v2 4/5] MdePkg/PiFirmwareFile: fix undefined behavior in FFS_FILE_SIZE

[Philippe Mathieu-Daudé]

On 4/18/19 7:47 PM, Laszlo Ersek wrote:
> Accessing "EFI_FFS_FILE_HEADER.Size", which is of type UINT8[3], through a
> (UINT32*), is undefined behavior. Fix it by accessing the array elements
> individually.
> 
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
> 
> Notes:
>     v2:
>     
>     - eliminate intermediate macros [Mike]
> 
>  MdePkg/Include/Pi/PiFirmwareFile.h | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/MdePkg/Include/Pi/PiFirmwareFile.h b/MdePkg/Include/Pi/PiFirmwareFile.h
> index 05470538de42..ec7729e9c36e 100644
> --- a/MdePkg/Include/Pi/PiFirmwareFile.h
> +++ b/MdePkg/Include/Pi/PiFirmwareFile.h
> @@ -179,8 +179,15 @@ typedef struct {
>  #define IS_FFS_FILE2(FfsFileHeaderPtr) \
>      (((((EFI_FFS_FILE_HEADER *) (UINTN) FfsFileHeaderPtr)->Attributes) & FFS_ATTRIB_LARGE_FILE) == FFS_ATTRIB_LARGE_FILE)
>  
> -#define FFS_FILE_SIZE(FfsFileHeaderPtr) \
> -    ((UINT32) (*((UINT32 *) ((EFI_FFS_FILE_HEADER *) (UINTN) FfsFileHeaderPtr)->Size) & 0x00ffffff))
> +///
> +/// The argument passed as the FfsFileHeaderPtr parameter to the
> +/// FFS_FILE_SIZE() function-like macro below must not have side effects:
> +/// FfsFileHeaderPtr is evaluated multiple times.
> +///
> +#define FFS_FILE_SIZE(FfsFileHeaderPtr) ((UINT32) ( \
> +    (((EFI_FFS_FILE_HEADER *) (UINTN) (FfsFileHeaderPtr))->Size[0]      ) | \
> +    (((EFI_FFS_FILE_HEADER *) (UINTN) (FfsFileHeaderPtr))->Size[1] <<  8) | \
> +    (((EFI_FFS_FILE_HEADER *) (UINTN) (FfsFileHeaderPtr))->Size[2] << 16)))
>  
>  #define FFS_FILE2_SIZE(FfsFileHeaderPtr) \
>      ((UINT32) (((EFI_FFS_FILE_HEADER2 *) (UINTN) FfsFileHeaderPtr)->ExtendedSize))
> 

Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>

[PATCH v2 5/5] OvmfPkg/Sec: fix out-of-bounds reads

[Laszlo Ersek]

RH covscan justifiedly reports that accessing "EFI_FFS_FILE_HEADER.Size"
and "EFI_COMMON_SECTION_HEADER.Size", which both are of type UINT8[3],
through (UINT32*), is undefined behavior:

> Error: OVERRUN (CWE-119):
> edk2-89910a39dcfd/OvmfPkg/Sec/SecMain.c:283: overrun-local: Overrunning
> array of 3 bytes at byte offset 3 by dereferencing pointer
> "(UINT32 *)File->Size".
> #  281|
> #  282|       File = (EFI_FFS_FILE_HEADER*)(UINTN) CurrentAddress;
> #  283|->     Size = *(UINT32*) File->Size & 0xffffff;
> #  284|       if (Size < (sizeof (*File) + sizeof (EFI_COMMON_SECTION_HEADER))) {
> #  285|         return EFI_VOLUME_CORRUPTED;
>
> Error: OVERRUN (CWE-119):
> edk2-89910a39dcfd/OvmfPkg/Sec/SecMain.c:614: overrun-local: Overrunning
> array of 3 bytes at byte offset 3 by dereferencing pointer
> "(UINT32 *)File->Size".
> #  612|
> #  613|       File = (EFI_FFS_FILE_HEADER*)(UINTN) CurrentAddress;
> #  614|->     Size = *(UINT32*) File->Size & 0xffffff;
> #  615|       if (Size < sizeof (*File)) {
> #  616|         return EFI_NOT_FOUND;
>
> Error: OVERRUN (CWE-119):
> edk2-89910a39dcfd/OvmfPkg/Sec/SecMain.c:639: overrun-local: Overrunning
> array of 3 bytes at byte offset 3 by dereferencing pointer
> "(UINT32 *)Section->Size".
> #  637|         Section = (EFI_COMMON_SECTION_HEADER*)(UINTN) CurrentAddress;
> #  638|
> #  639|->       Size = *(UINT32*) Section->Size & 0xffffff;
> #  640|         if (Size < sizeof (*Section)) {
> #  641|           return EFI_NOT_FOUND;

Fix these by invoking the FFS_FILE_SIZE() and SECTION_SIZE() macros, which
by now have been fixed too.

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
Issue: scan-1008.txt
Issue: scan-1009.txt
Issue: scan-1010.txt
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
---

Notes:
    v2:
    
    - pick up Ard's A-b
    
    - pick up Phil's R-b

 OvmfPkg/Sec/SecMain.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
index 18a89c649fd4..3914355cd17b 100644
--- a/OvmfPkg/Sec/SecMain.c
+++ b/OvmfPkg/Sec/SecMain.c
@@ -274,7 +274,7 @@ FindFfsFileAndSection (
     }
 
     File = (EFI_FFS_FILE_HEADER*)(UINTN) CurrentAddress;
-    Size = *(UINT32*) File->Size & 0xffffff;
+    Size = FFS_FILE_SIZE (File);
     if (Size < (sizeof (*File) + sizeof (EFI_COMMON_SECTION_HEADER))) {
       return EFI_VOLUME_CORRUPTED;
     }
@@ -605,7 +605,7 @@ FindImageBase (
     }
 
     File = (EFI_FFS_FILE_HEADER*)(UINTN) CurrentAddress;
-    Size = *(UINT32*) File->Size & 0xffffff;
+    Size = FFS_FILE_SIZE (File);
     if (Size < sizeof (*File)) {
       return EFI_NOT_FOUND;
     }
@@ -630,7 +630,7 @@ FindImageBase (
       CurrentAddress = (EndOfSection + 3) & 0xfffffffffffffffcULL;
       Section = (EFI_COMMON_SECTION_HEADER*)(UINTN) CurrentAddress;
 
-      Size = *(UINT32*) Section->Size & 0xffffff;
+      Size = SECTION_SIZE (Section);
       if (Size < sizeof (*Section)) {
         return EFI_NOT_FOUND;
       }
-- 
2.19.1.3.g30247aa5d201

Re: [PATCH v2 0/5] patches for some warnings raised by "RH covscan"

[Michael D Kinney]

Series Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>

> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com]
> Sent: Thursday, April 18, 2019 10:47 AM
> To: edk2-devel-groups-io <devel@edk2.groups.io>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>; Feng,
> Bob C <bob.c.feng@intel.com>; Justen, Jordan L
> <jordan.l.justen@intel.com>; Gao, Liming
> <liming.gao@intel.com>; Kinney, Michael D
> <michael.d.kinney@intel.com>; Zhu, Yonghong
> <yonghong.zhu@intel.com>
> Subject: [PATCH v2 0/5] patches for some warnings
> raised by "RH covscan"
> 
> Bugzilla:
> https://bugzilla.tianocore.org/show_bug.cgi?id=1710
> Repo:     https://github.com/lersek/edk2.git
> Branch:   covscan_bz_1710_v2
> 
> Patch-level updates relative to v1 have been noted on
> the patches
> themselves. And earlier I described the changes to the
> series's
> structure at
> <https://edk2.groups.io/g/devel/message/39301>.
> 
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Bob Feng <bob.c.feng@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Yonghong Zhu <yonghong.zhu@intel.com>
> 
> Thanks
> Laszlo
> 
> Laszlo Ersek (5):
>   MdePkg/PiFirmwareFile: express IS_SECTION2 in terms
> of SECTION_SIZE
>   MdePkg/PiFirmwareFile: fix undefined behavior in
> SECTION_SIZE
>   BaseTools/PiFirmwareFile: fix undefined behavior in
> SECTION_SIZE
>   MdePkg/PiFirmwareFile: fix undefined behavior in
> FFS_FILE_SIZE
>   OvmfPkg/Sec: fix out-of-bounds reads
> 
>  BaseTools/Source/C/Include/Common/PiFirmwareFile.h |
> 11 +++++++--
>  MdePkg/Include/Pi/PiFirmwareFile.h                 |
> 26 +++++++++++++++-----
>  OvmfPkg/Sec/SecMain.c                              |
> 6 ++---
>  3 files changed, 32 insertions(+), 11 deletions(-)
> 
> --
> 2.19.1.3.g30247aa5d201

Re: [PATCH v2 0/5] patches for some warnings raised by "RH covscan"

[Jordan Justen]

Series Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>

On 2019-04-18 10:47:05, Laszlo Ersek wrote:
> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
> Repo:     https://github.com/lersek/edk2.git
> Branch:   covscan_bz_1710_v2
> 
> Patch-level updates relative to v1 have been noted on the patches
> themselves. And earlier I described the changes to the series's
> structure at <https://edk2.groups.io/g/devel/message/39301>.
> 
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Bob Feng <bob.c.feng@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Yonghong Zhu <yonghong.zhu@intel.com>
> 
> Thanks
> Laszlo
> 
> Laszlo Ersek (5):
>   MdePkg/PiFirmwareFile: express IS_SECTION2 in terms of SECTION_SIZE
>   MdePkg/PiFirmwareFile: fix undefined behavior in SECTION_SIZE
>   BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE
>   MdePkg/PiFirmwareFile: fix undefined behavior in FFS_FILE_SIZE
>   OvmfPkg/Sec: fix out-of-bounds reads
> 
>  BaseTools/Source/C/Include/Common/PiFirmwareFile.h | 11 +++++++--
>  MdePkg/Include/Pi/PiFirmwareFile.h                 | 26 +++++++++++++++-----
>  OvmfPkg/Sec/SecMain.c                              |  6 ++---
>  3 files changed, 32 insertions(+), 11 deletions(-)
> 
> -- 
> 2.19.1.3.g30247aa5d201
> 

Re: [edk2-devel] [PATCH v2 0/5] patches for some warnings raised by "RH covscan"

[Laszlo Ersek]

On 04/18/19 19:47, Laszlo Ersek wrote:
> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
> Repo:     https://github.com/lersek/edk2.git
> Branch:   covscan_bz_1710_v2
> 
> Patch-level updates relative to v1 have been noted on the patches
> themselves. And earlier I described the changes to the series's
> structure at <https://edk2.groups.io/g/devel/message/39301>.
> 
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Bob Feng <bob.c.feng@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Yonghong Zhu <yonghong.zhu@intel.com>
> 
> Thanks
> Laszlo
> 
> Laszlo Ersek (5):
>   MdePkg/PiFirmwareFile: express IS_SECTION2 in terms of SECTION_SIZE
>   MdePkg/PiFirmwareFile: fix undefined behavior in SECTION_SIZE
>   BaseTools/PiFirmwareFile: fix undefined behavior in SECTION_SIZE
>   MdePkg/PiFirmwareFile: fix undefined behavior in FFS_FILE_SIZE
>   OvmfPkg/Sec: fix out-of-bounds reads
> 
>  BaseTools/Source/C/Include/Common/PiFirmwareFile.h | 11 +++++++--
>  MdePkg/Include/Pi/PiFirmwareFile.h                 | 26 +++++++++++++++-----
>  OvmfPkg/Sec/SecMain.c                              |  6 ++---
>  3 files changed, 32 insertions(+), 11 deletions(-)
> 

Series pushed as commit range 1a734ed85fda..b9d4847ec258.

Thank you all,
Laszlo