public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH 1/1] uefi-sct/SctPkg: NULL deref in DevicePathToText test
@ 2020-10-29 20:01 Heinrich Schuchardt
  2020-11-04 15:52 ` [edk2-devel] " G Edhaya Chandran
  2020-11-24 16:07 ` G Edhaya Chandran
  0 siblings, 2 replies; 8+ messages in thread
From: Heinrich Schuchardt @ 2020-10-29 20:01 UTC (permalink / raw)
  To: Samer El-Haj-Mahmoud, Eric Jin, G Edhaya Chandran,
	EDK II Development
  Cc: Grant Likely, Heinrich Schuchardt

Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3029

Function DevicePathToTextConvertDeviceNodeToTextCoverageTest() tests if
DeviceNodeToText() correctly converts a Relative Offset Range node. After
calling SctConvertTextToDeviceNode() it tries to set the field Reserved
of the returned device node to 0.

If the tested firmware does not return the expected text
SctConvertTextToDeviceNode() may return NULL or a device node that is
shorter than expected. In both cases it is not possible to access the
field Reserved.

So we must check both that the returned node is not NULL and that it has
the exepected size.

Due to the missing check a NULL dereference was observed when running the
SCT on U-Boot.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 .../BlackBoxTest/DevicePathToTextBBTestCoverage.c         | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/uefi-sct/SctPkg/TestCase/UEFI/EFI/Protocol/DevicePathToText/BlackBoxTest/DevicePathToTextBBTestCoverage.c b/uefi-sct/SctPkg/TestCase/UEFI/EFI/Protocol/DevicePathToText/BlackBoxTest/DevicePathToTextBBTestCoverage.c
index ee91bdfb..784d4748 100644
--- a/uefi-sct/SctPkg/TestCase/UEFI/EFI/Protocol/DevicePathToText/BlackBoxTest/DevicePathToTextBBTestCoverage.c
+++ b/uefi-sct/SctPkg/TestCase/UEFI/EFI/Protocol/DevicePathToText/BlackBoxTest/DevicePathToTextBBTestCoverage.c
@@ -1198,8 +1198,12 @@ DevicePathToTextConvertDeviceNodeToTextCoverageTest (
   ((MEDIA_OFFSET_DEVICE_PATH *)pDeviceNode1)->EndingOffset = 0x1234;
   Text = DevicePathToText->ConvertDeviceNodeToText (pDeviceNode1, FALSE, FALSE);
   pDeviceNode2 = SctConvertTextToDeviceNode(Text);
-  ((MEDIA_OFFSET_DEVICE_PATH *)pDeviceNode2)->Reserved = 0;
-
+  SctPrint(L"pDeviceNode2 = %p\n", pDeviceNode2);
+  if (pDeviceNode2 &&
+      ((MEDIA_OFFSET_DEVICE_PATH *)pDeviceNode2)->Length ==
+      sizeof(MEDIA_OFFSET_DEVICE_PATH)) {
+    ((MEDIA_OFFSET_DEVICE_PATH *)pDeviceNode2)->Reserved = 0;
+  }
   if ((pDeviceNode2 != NULL) && (SctCompareMem (pDeviceNode2, pDeviceNode1, SctDevicePathNodeLength(pDeviceNode1)) == 0)) {
     AssertionType = EFI_TEST_ASSERTION_PASSED;
   } else {
-- 
2.28.0


^ permalink raw reply related	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-11-25  6:40 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-10-29 20:01 [PATCH 1/1] uefi-sct/SctPkg: NULL deref in DevicePathToText test Heinrich Schuchardt
2020-11-04 15:52 ` [edk2-devel] " G Edhaya Chandran
2020-11-23 10:25   ` Grant Likely
2020-11-24 16:07 ` G Edhaya Chandran
2020-11-24 16:26   ` Heinrich Schuchardt
2020-11-24 16:33     ` G Edhaya Chandran
2020-11-24 17:08       ` Heinrich Schuchardt
2020-11-25  6:40         ` G Edhaya Chandran

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox