* [Patch 1/2] MdePkg UefiDevicePathLib: Validate buffer length before use buffer.
2016-10-12 12:39 [Patch 0/2] MdePkg DevicePathLib: Check buffer length before use Eric Dong
@ 2016-10-12 12:39 ` Eric Dong
2016-10-12 12:39 ` [Patch 2/2] MdePkg UefiDevicePathLibDevicePathProtocol: Validate before use Eric Dong
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Eric Dong @ 2016-10-12 12:39 UTC (permalink / raw)
To: edk2-devel, michael.d.kinney, liming.gao; +Cc: Ruiyu Ni
In IsDevicePathValid API, code should validate the device path
buffer not exceed the input MaxSize before reference the path
info.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
---
.../UefiDevicePathLib/DevicePathUtilities.c | 25 ++++++++++++++++------
1 file changed, 18 insertions(+), 7 deletions(-)
diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
index 7f21a60..48743c5 100644
--- a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
+++ b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c
@@ -8,7 +8,7 @@
environment varibles. Multi-instance device paths should never be placed
on a Handle.
- Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -61,25 +61,35 @@ IsDevicePathValid (
ASSERT (DevicePath != NULL);
- for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {
+ if (MaxSize == 0){
+ MaxSize = MAX_UINTN;
+ }
+
+ Size = 0;
+ Count = 0;
+
+ while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) && \
+ (MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) && \
+ !IsDevicePathEnd (DevicePath)) {
NodeLength = DevicePathNodeLength (DevicePath);
if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {
return FALSE;
}
- if (MaxSize > 0) {
- Size += NodeLength;
- if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {
- return FALSE;
- }
+ if (NodeLength > MAX_UINTN - Size) {
+ return FALSE;
}
+ Size += NodeLength;
+
if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {
Count++;
if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) {
return FALSE;
}
}
+
+ DevicePath = NextDevicePathNode (DevicePath);
}
//
@@ -88,6 +98,7 @@ IsDevicePathValid (
return (BOOLEAN) (DevicePathNodeLength (DevicePath) == END_DEVICE_PATH_LENGTH);
}
+
/**
Returns the Type field of a device path node.
--
2.6.4.windows.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [Patch 2/2] MdePkg UefiDevicePathLibDevicePathProtocol: Validate before use.
2016-10-12 12:39 [Patch 0/2] MdePkg DevicePathLib: Check buffer length before use Eric Dong
2016-10-12 12:39 ` [Patch 1/2] MdePkg UefiDevicePathLib: Validate buffer length before use buffer Eric Dong
@ 2016-10-12 12:39 ` Eric Dong
2016-10-12 14:14 ` [Patch 0/2] MdePkg DevicePathLib: Check buffer length " Laszlo Ersek
2016-10-14 1:36 ` Ni, Ruiyu
3 siblings, 0 replies; 5+ messages in thread
From: Eric Dong @ 2016-10-12 12:39 UTC (permalink / raw)
To: edk2-devel, michael.d.kinney, liming.gao; +Cc: Ruiyu Ni
In IsDevicePathValid API, code should validate the device path
buffer not exceed the input MaxSize before reference the path
info.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
---
.../UefiDevicePathLib.c | 24 +++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
index 5cc4b35..ae1000e 100644
--- a/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
+++ b/MdePkg/Library/UefiDevicePathLibDevicePathProtocol/UefiDevicePathLib.c
@@ -2,7 +2,7 @@
Library instance that implement UEFI Device Path Library class based on protocol
gEfiDevicePathUtilitiesProtocolGuid.
- Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -103,25 +103,35 @@ IsDevicePathValid (
ASSERT (DevicePath != NULL);
- for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {
+ if (MaxSize == 0){
+ MaxSize = MAX_UINTN;
+ }
+
+ Size = 0;
+ Count = 0;
+
+ while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) && \
+ (MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) && \
+ !IsDevicePathEnd (DevicePath)) {
NodeLength = DevicePathNodeLength (DevicePath);
if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {
return FALSE;
}
- if (MaxSize > 0) {
- Size += NodeLength;
- if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {
- return FALSE;
- }
+ if (NodeLength > MAX_UINTN - Size) {
+ return FALSE;
}
+ Size += NodeLength;
+
if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {
Count++;
if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) {
return FALSE;
}
}
+
+ DevicePath = NextDevicePathNode (DevicePath);
}
//
--
2.6.4.windows.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Patch 0/2] MdePkg DevicePathLib: Check buffer length before use.
2016-10-12 12:39 [Patch 0/2] MdePkg DevicePathLib: Check buffer length before use Eric Dong
2016-10-12 12:39 ` [Patch 1/2] MdePkg UefiDevicePathLib: Validate buffer length before use buffer Eric Dong
2016-10-12 12:39 ` [Patch 2/2] MdePkg UefiDevicePathLibDevicePathProtocol: Validate before use Eric Dong
@ 2016-10-12 14:14 ` Laszlo Ersek
2016-10-14 1:36 ` Ni, Ruiyu
3 siblings, 0 replies; 5+ messages in thread
From: Laszlo Ersek @ 2016-10-12 14:14 UTC (permalink / raw)
To: Eric Dong, edk2-devel, michael.d.kinney, liming.gao
On 10/12/16 14:39, Eric Dong wrote:
> In IsDevicePathValid API, code should validate the device path
> buffer not exceed the input MaxSize before reference the path
> info. This patched series add this check.
>
> Eric Dong (2):
> MdePkg UefiDevicePathLib: Validate buffer length before use buffer.
> MdePkg UefiDevicePathLibDevicePathProtocol: Validate before use.
>
> .../UefiDevicePathLib/DevicePathUtilities.c | 25 ++++++++++++++++------
> .../UefiDevicePathLib.c | 24 +++++++++++++++------
> 2 files changed, 35 insertions(+), 14 deletions(-)
>
Just a syntactic remark: you don't need the backslash (\) after the
trailing logical-and (&&) operators.
Thanks
Laszlo
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Patch 0/2] MdePkg DevicePathLib: Check buffer length before use.
2016-10-12 12:39 [Patch 0/2] MdePkg DevicePathLib: Check buffer length before use Eric Dong
` (2 preceding siblings ...)
2016-10-12 14:14 ` [Patch 0/2] MdePkg DevicePathLib: Check buffer length " Laszlo Ersek
@ 2016-10-14 1:36 ` Ni, Ruiyu
3 siblings, 0 replies; 5+ messages in thread
From: Ni, Ruiyu @ 2016-10-14 1:36 UTC (permalink / raw)
To: Dong, Eric, edk2-devel@lists.01.org, Kinney, Michael D,
Gao, Liming
Please remove the ending back-slash in following lines. They are not needed.
+ while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) && \
+ (MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) && \
+ !IsDevicePathEnd (DevicePath)) {
With the above changes, Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
>-----Original Message-----
>From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Eric Dong
>Sent: Wednesday, October 12, 2016 8:39 PM
>To: edk2-devel@lists.01.org; Kinney, Michael D <michael.d.kinney@intel.com>; Gao, Liming <liming.gao@intel.com>
>Subject: [edk2] [Patch 0/2] MdePkg DevicePathLib: Check buffer length before use.
>
>In IsDevicePathValid API, code should validate the device path
>buffer not exceed the input MaxSize before reference the path
>info. This patched series add this check.
>
>Eric Dong (2):
> MdePkg UefiDevicePathLib: Validate buffer length before use buffer.
> MdePkg UefiDevicePathLibDevicePathProtocol: Validate before use.
>
> .../UefiDevicePathLib/DevicePathUtilities.c | 25 ++++++++++++++++------
> .../UefiDevicePathLib.c | 24 +++++++++++++++------
> 2 files changed, 35 insertions(+), 14 deletions(-)
>
>--
>2.6.4.windows.1
>
>_______________________________________________
>edk2-devel mailing list
>edk2-devel@lists.01.org
>https://lists.01.org/mailman/listinfo/edk2-devel
^ permalink raw reply [flat|nested] 5+ messages in thread