public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: Hao Wu <hao.a.wu@intel.com>
To: edk2-devel@lists.01.org
Cc: Hao Wu <hao.a.wu@intel.com>, Liming Gao <liming.gao@intel.com>,
	Yonghong Zhu <yonghong.zhu@intel.com>
Subject: [PATCH 22/52] BaseTools/GenFv: Fix potential access over array bounds
Date: Wed, 12 Oct 2016 20:20:06 +0800	[thread overview]
Message-ID: <1476274836-10544-23-git-send-email-hao.a.wu@intel.com> (raw)
In-Reply-To: <1476274836-10544-1-git-send-email-hao.a.wu@intel.com>

Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
 BaseTools/Source/C/GenFv/GenFv.c            |  9 +++--
 BaseTools/Source/C/GenFv/GenFvInternalLib.c | 55 +++++++++++++++++++++++++++--
 2 files changed, 59 insertions(+), 5 deletions(-)

diff --git a/BaseTools/Source/C/GenFv/GenFv.c b/BaseTools/Source/C/GenFv/GenFv.c
index 01ae37a..4de24b9 100644
--- a/BaseTools/Source/C/GenFv/GenFv.c
+++ b/BaseTools/Source/C/GenFv/GenFv.c
@@ -4,7 +4,7 @@
   can be found in the Tiano Firmware Volume Generation Utility 
   Specification, review draft.
 
-Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials                          
 are licensed and made available under the terms and conditions of the BSD License         
 which accompanies this distribution.  The full text of the license may be found at        
@@ -337,7 +337,12 @@ Returns:
         Error (NULL, 0, 1003, "Invalid option value", "Input Ffsfile can't be null");
         return STATUS_ERROR;
       }
-      strcpy (mFvDataInfo.FvFiles[Index], argv[1]);
+      if (strlen (argv[1]) > MAX_LONG_FILE_PATH - 1) {
+        Error (NULL, 0, 1003, "Invalid option value", "Input Ffsfile name %s is too long!", argv[1]);
+        return STATUS_ERROR;
+      }
+      strncpy (mFvDataInfo.FvFiles[Index], argv[1], MAX_LONG_FILE_PATH - 1);
+      mFvDataInfo.FvFiles[Index][MAX_LONG_FILE_PATH - 1] = 0;
       DebugMsg (NULL, 0, 9, "FV component file", "the %uth name is %s", (unsigned) Index + 1, argv[1]);
       argc -= 2;
       argv += 2;
diff --git a/BaseTools/Source/C/GenFv/GenFvInternalLib.c b/BaseTools/Source/C/GenFv/GenFvInternalLib.c
index 8c769b4..d7c650e 100644
--- a/BaseTools/Source/C/GenFv/GenFvInternalLib.c
+++ b/BaseTools/Source/C/GenFv/GenFvInternalLib.c
@@ -374,7 +374,7 @@ Returns:
     }
   }
 
-  for (Index = 0; Index < MAX_NUMBER_OF_FILES_IN_FV; Index++) {
+  for (Index = 0; Number + Index < MAX_NUMBER_OF_FILES_IN_FV; Index++) {
     //
     // Read the FFS file list
     //
@@ -2418,17 +2418,19 @@ Returns:
   UINT8                           *FvImage;
   UINTN                           FvImageSize;
   FILE                            *FvFile;
-  CHAR8                           FvMapName [MAX_LONG_FILE_PATH];
+  CHAR8                           *FvMapName;
   FILE                            *FvMapFile;
   EFI_FIRMWARE_VOLUME_EXT_HEADER  *FvExtHeader;
   FILE                            *FvExtHeaderFile;
   UINTN                           FileSize;
-  CHAR8                           FvReportName[MAX_LONG_FILE_PATH];
+  CHAR8                           *FvReportName;
   FILE                            *FvReportFile;
 
   FvBufferHeader = NULL;
   FvFile         = NULL;
+  FvMapName      = NULL;
   FvMapFile      = NULL;
+  FvReportName   = NULL;
   FvReportFile   = NULL;
 
   if (InfFileImage != NULL) {
@@ -2566,8 +2568,34 @@ Returns:
   // FvMap file to log the function address of all modules in one Fvimage
   //
   if (MapFileName != NULL) {
+    if (strlen (MapFileName) > MAX_LONG_FILE_PATH - 1) {
+      Error (NULL, 0, 1003, "Invalid option value", "MapFileName %s is too long!", MapFileName);
+      Status = EFI_ABORTED;
+      goto Finish;
+    }
+
+    FvMapName = malloc (strlen (MapFileName) + 1);
+    if (FvMapName == NULL) {
+      Error (NULL, 0, 4001, "Resource", "memory cannot be allocated!");
+      Status = EFI_OUT_OF_RESOURCES;
+      goto Finish;
+    }
+
     strcpy (FvMapName, MapFileName);
   } else {
+    if (strlen (FvFileName) + strlen (".map") > MAX_LONG_FILE_PATH - 1) {
+      Error (NULL, 0, 1003, "Invalid option value", "FvFileName %s is too long!", FvFileName);
+      Status = EFI_ABORTED;
+      goto Finish;
+    }
+
+    FvMapName = malloc (strlen (FvFileName) + strlen (".map") + 1);
+    if (FvMapName == NULL) {
+      Error (NULL, 0, 4001, "Resource", "memory cannot be allocated!");
+      Status = EFI_OUT_OF_RESOURCES;
+      goto Finish;
+    }
+
     strcpy (FvMapName, FvFileName);
     strcat (FvMapName, ".map");
   }
@@ -2576,6 +2604,19 @@ Returns:
   //
   // FvReport file to log the FV information in one Fvimage
   //
+  if (strlen (FvFileName) + strlen (".txt") > MAX_LONG_FILE_PATH - 1) {
+    Error (NULL, 0, 1003, "Invalid option value", "FvFileName %s is too long!", FvFileName);
+    Status = EFI_ABORTED;
+    goto Finish;
+  }
+
+  FvReportName = malloc (strlen (FvFileName) + strlen (".txt") + 1);
+  if (FvReportName == NULL) {
+    Error (NULL, 0, 4001, "Resource", "memory cannot be allocated!");
+    Status = EFI_OUT_OF_RESOURCES;
+    goto Finish;
+  }
+
   strcpy (FvReportName, FvFileName);
   strcat (FvReportName, ".txt");
 
@@ -2852,6 +2893,14 @@ Finish:
   if (FvExtHeader != NULL) {
     free (FvExtHeader);
   }
+
+  if (FvMapName != NULL) {
+    free (FvMapName);
+  }
+
+  if (FvReportName != NULL) {
+    free (FvReportName);
+  }
   
   if (FvFile != NULL) {
     fflush (FvFile);
-- 
1.9.5.msysgit.0



  parent reply	other threads:[~2016-10-12 12:21 UTC|newest]

Thread overview: 55+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-10-12 12:19 [PATCH 00/52] Resolve issues for C source codes in BaseTools Hao Wu
2016-10-12 12:19 ` [PATCH 01/52] BaseTools/C/Common: Avoid possible NULL pointer dereference Hao Wu
2016-10-12 12:19 ` [PATCH 02/52] BaseTools/EfiRom: " Hao Wu
2016-10-12 12:19 ` [PATCH 03/52] BaseTools/GenFfs: " Hao Wu
2016-10-12 12:19 ` [PATCH 04/52] BaseTools/GenFv: " Hao Wu
2016-10-12 12:19 ` [PATCH 05/52] BaseTools/GenFw: " Hao Wu
2016-10-12 12:19 ` [PATCH 06/52] BaseTools/GenPage: " Hao Wu
2016-10-12 12:19 ` [PATCH 07/52] BaseTools/GenSec: " Hao Wu
2016-10-12 12:19 ` [PATCH 08/52] BaseTools/GenVtf: " Hao Wu
2016-10-12 12:19 ` [PATCH 09/52] BaseTools/TianoCompress: " Hao Wu
2016-10-12 12:19 ` [PATCH 10/52] BaseTools/VfrCompile: " Hao Wu
2016-10-12 12:19 ` [PATCH 11/52] BaseTools/VolInfo: " Hao Wu
2016-10-12 12:19 ` [PATCH 12/52] BaseTools/TianoCompress: Initialize local variables before being used Hao Wu
2016-10-12 12:19 ` [PATCH 13/52] BaseTools/VfrCompile: " Hao Wu
2016-10-12 12:19 ` [PATCH 14/52] BaseTools/GenBootSector: Fix parameter format mismatch in printf functions Hao Wu
2016-10-12 12:19 ` [PATCH 15/52] BaseTools/VolInfo: " Hao Wu
2016-10-12 12:20 ` [PATCH 16/52] BaseTools/C/Common: Fix parameter format mismatch in scanf functions Hao Wu
2016-10-12 12:20 ` [PATCH 17/52] BaseTools/GenFv: " Hao Wu
2016-10-12 12:20 ` [PATCH 18/52] BaseTools/GenFw: " Hao Wu
2016-10-12 12:20 ` [PATCH 19/52] BaseTools/GenVtf: " Hao Wu
2016-10-12 12:20 ` [PATCH 20/52] BaseTools/C/Common: Fix potential access over array bounds Hao Wu
2016-10-12 12:20 ` [PATCH 21/52] BaseTools/EfiRom: " Hao Wu
2016-10-12 12:20 ` Hao Wu [this message]
2016-10-12 12:20 ` [PATCH 23/52] BaseTools/TianoCompress: " Hao Wu
2016-10-12 12:20 ` [PATCH 24/52] BaseTools/VfrCompile: " Hao Wu
2016-10-12 12:20 ` [PATCH 25/52] BaseTools/VfrCompile: Avoid freeing memory with mismatched functions Hao Wu
2016-10-12 12:20 ` [PATCH 26/52] BaseTools/VfrCompile: Add assignment operator definition for some classes Hao Wu
2016-10-12 12:20 ` [PATCH 27/52] BaseTools/VfrCompile: Avoid freeing freed memory in classes Hao Wu
2016-10-12 12:20 ` [PATCH 28/52] BaseTools/VfrCompile: Remove unused local variables Hao Wu
2016-10-12 12:20 ` [PATCH 29/52] BaseTools/C/Common: Fix potential memory leak Hao Wu
2016-10-12 12:20 ` [PATCH 30/52] BaseTools/EfiRom: " Hao Wu
2016-10-12 12:20 ` [PATCH 31/52] BaseTools/GenFv: " Hao Wu
2016-10-12 12:20 ` [PATCH 32/52] BaseTools/GenPage: " Hao Wu
2016-10-12 12:20 ` [PATCH 33/52] BaseTools/GenSec: " Hao Wu
2016-10-12 12:20 ` [PATCH 34/52] BaseTools/GenVtf: " Hao Wu
2016-10-12 12:20 ` [PATCH 35/52] BaseTools/Split: Fix potential memory and resource leak Hao Wu
2016-10-12 12:20 ` [PATCH 36/52] BaseTools/TianoCompress: Fix potential memory leak Hao Wu
2016-10-12 12:20 ` [PATCH 37/52] BaseTools/VfrCompile: " Hao Wu
2016-10-12 12:20 ` [PATCH 38/52] BaseTools/VolInfo: " Hao Wu
2016-10-12 12:20 ` [PATCH 39/52] BaseTools/EfiRom: Fix file handles not being closed Hao Wu
2016-10-12 12:20 ` [PATCH 40/52] BaseTools/GenBootSector: " Hao Wu
2016-10-12 12:20 ` [PATCH 41/52] BaseTools/GenCrc32: " Hao Wu
2016-10-12 12:20 ` [PATCH 42/52] BaseTools/GenFv: " Hao Wu
2016-10-12 12:20 ` [PATCH 43/52] BaseTools/GenVtf: " Hao Wu
2016-10-12 12:20 ` [PATCH 44/52] BaseTools/LzmaCompress: " Hao Wu
2016-10-12 12:20 ` [PATCH 45/52] BaseTools/TianoCompress: " Hao Wu
2016-10-12 12:20 ` [PATCH 46/52] BaseTools/VolInfo: " Hao Wu
2016-10-12 12:20 ` [PATCH 47/52] BaseTools/GenVtf: Fix potential buffer overflow in scanf functions Hao Wu
2016-10-12 12:20 ` [PATCH 48/52] BaseTools/VolInfo: " Hao Wu
2016-10-12 12:20 ` [PATCH 49/52] BaseTools/VfrCompile: Explicitly state format string for DebugMsg() Hao Wu
2016-10-12 12:20 ` [PATCH 50/52] BaseTools/VolInfo: Use hard-coded format string for calls to sprintf() Hao Wu
2016-10-12 12:20 ` [PATCH 51/52] BaseTools/VfrCompile/Pccts: Add virtual destructor for class DLGInputStream Hao Wu
2016-10-12 12:20 ` [PATCH 52/52] BaseTools/VfrCompile/Pccts: Make assignment operator not returning void Hao Wu
2016-10-18  1:12   ` Dong, Eric
2016-10-17  7:45 ` [PATCH 00/52] Resolve issues for C source codes in BaseTools Gao, Liming

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1476274836-10544-23-git-send-email-hao.a.wu@intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox