From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by ml01.01.org (Postfix) with ESMTP id 15F201A1E10 for ; Tue, 2 Aug 2016 04:32:33 -0700 (PDT) Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga102.jf.intel.com with ESMTP; 02 Aug 2016 04:32:32 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,460,1464678000"; d="scan'208";a="743069550" Received: from shwde7156.ccr.corp.intel.com ([10.239.158.52]) by FMSMGA003.fm.intel.com with ESMTP; 02 Aug 2016 04:32:32 -0700 From: Eric Dong To: edk2-devel@lists.01.org Cc: Star Zeng Date: Tue, 2 Aug 2016 19:32:30 +0800 Message-Id: <1470137550-65284-1-git-send-email-eric.dong@intel.com> X-Mailer: git-send-email 2.6.4.windows.1 Subject: [Patch] SecurityPkg OpalPasswordDxe: Fix buffer overflow issue. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Aug 2016 11:32:33 -0000 In current code, PSID is processed as string and the length is 0x20. Current code only reserved 0x20 length buffer for it, no extra buffer for the '\0'. When driver call UnicodeStrToAsciiStrS to convert PSID, it search the '\0' for the end. So extra dirty data saved in PSID info which caused PSID revert action failed. This patch reserved extra 1 byte data for the '\0'. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Eric Dong Cc: Star Zeng --- SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c | 5 ++++- SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormValues.h | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c index 9a44c56..ee73697 100644 --- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c +++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c @@ -595,12 +595,15 @@ HiiPsidRevert( OPAL_DISK *OpalDisk; TCG_RESULT Ret; OPAL_SESSION Session; + UINT8 TmpBuf[PSID_CHARACTER_STRING_END_LENGTH]; Ret = TcgResultFailure; OpalHiiGetBrowserData(); - UnicodeStrToAsciiStrS (gHiiConfiguration.Psid, (CHAR8*)Psid.Psid, PSID_CHARACTER_LENGTH); + ZeroMem (TmpBuf, sizeof (TmpBuf)); + UnicodeStrToAsciiStrS (gHiiConfiguration.Psid, (CHAR8*)TmpBuf, PSID_CHARACTER_STRING_END_LENGTH); + CopyMem (Psid.Psid, TmpBuf, PSID_CHARACTER_LENGTH); OpalDisk = HiiGetOpalDiskCB (gHiiConfiguration.SelectedDiskIndex); if (OpalDisk != NULL) { diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormValues.h b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormValues.h index 138bcb8..88cf9f5 100644 --- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormValues.h +++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormValues.h @@ -21,6 +21,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. // PSID Length #define PSID_CHARACTER_LENGTH 0x20 +#define PSID_CHARACTER_STRING_END_LENGTH 0x21 // ID's for various forms that will be used by HII #define FORMID_VALUE_MAIN_MENU 0x01 @@ -38,7 +39,7 @@ typedef struct { UINT8 KeepUserData; UINT16 AvailableFields; UINT16 Password[MAX_PASSWORD_CHARACTER_LENGTH]; - UINT16 Psid[PSID_CHARACTER_LENGTH]; + UINT16 Psid[PSID_CHARACTER_STRING_END_LENGTH]; UINT8 EnableBlockSid; } OPAL_HII_CONFIGURATION; #pragma pack() -- 2.6.4.windows.1