From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) (using TLSv1 with cipher CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 017601A1E9E for ; Wed, 12 Oct 2016 05:39:31 -0700 (PDT) Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga102.jf.intel.com with ESMTP; 12 Oct 2016 05:39:32 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.31,482,1473145200"; d="scan'208";a="19266650" Received: from shwde7156.ccr.corp.intel.com ([10.239.158.52]) by orsmga004.jf.intel.com with ESMTP; 12 Oct 2016 05:39:30 -0700 From: Eric Dong To: edk2-devel@lists.01.org, michael.d.kinney@intel.com, liming.gao@intel.com Cc: Ruiyu Ni Date: Wed, 12 Oct 2016 20:39:26 +0800 Message-Id: <1476275967-10888-2-git-send-email-eric.dong@intel.com> X-Mailer: git-send-email 2.6.4.windows.1 In-Reply-To: <1476275967-10888-1-git-send-email-eric.dong@intel.com> References: <1476275967-10888-1-git-send-email-eric.dong@intel.com> Subject: [Patch 1/2] MdePkg UefiDevicePathLib: Validate buffer length before use buffer. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Oct 2016 12:39:32 -0000 In IsDevicePathValid API, code should validate the device path buffer not exceed the input MaxSize before reference the path info. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Eric Dong Cc: Ruiyu Ni --- .../UefiDevicePathLib/DevicePathUtilities.c | 25 ++++++++++++++++------ 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c index 7f21a60..48743c5 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c @@ -8,7 +8,7 @@ environment varibles. Multi-instance device paths should never be placed on a Handle. - Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.
+ Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -61,25 +61,35 @@ IsDevicePathValid ( ASSERT (DevicePath != NULL); - for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) { + if (MaxSize == 0){ + MaxSize = MAX_UINTN; + } + + Size = 0; + Count = 0; + + while (MaxSize >= sizeof (EFI_DEVICE_PATH_PROTOCOL) && \ + (MaxSize - sizeof (EFI_DEVICE_PATH_PROTOCOL) >= Size) && \ + !IsDevicePathEnd (DevicePath)) { NodeLength = DevicePathNodeLength (DevicePath); if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) { return FALSE; } - if (MaxSize > 0) { - Size += NodeLength; - if (Size + END_DEVICE_PATH_LENGTH > MaxSize) { - return FALSE; - } + if (NodeLength > MAX_UINTN - Size) { + return FALSE; } + Size += NodeLength; + if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) { Count++; if (Count >= PcdGet32 (PcdMaximumDevicePathNodeCount)) { return FALSE; } } + + DevicePath = NextDevicePathNode (DevicePath); } // @@ -88,6 +98,7 @@ IsDevicePathValid ( return (BOOLEAN) (DevicePathNodeLength (DevicePath) == END_DEVICE_PATH_LENGTH); } + /** Returns the Type field of a device path node. -- 2.6.4.windows.1