* [Patch] MdeModulePkg FileExplorerLib: Fix potential Integer Overflow.
@ 2016-10-14 6:49 Liming Gao
2016-10-14 12:18 ` Laszlo Ersek
0 siblings, 1 reply; 2+ messages in thread
From: Liming Gao @ 2016-10-14 6:49 UTC (permalink / raw)
To: edk2-devel
In function 'LibAppendFileName' of 'FileExplorer.c':
"
MaxLen = (Size1 + Size2 + sizeof (CHAR16))/ sizeof (CHAR16);
"
Overflow may happen here. MaxLen might become a very small number.
This patch adds integer overflow checker.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
---
.../Library/FileExplorerLib/FileExplorer.c | 28 ++++++++++++++++++++--
1 file changed, 26 insertions(+), 2 deletions(-)
diff --git a/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c b/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c
index 59c851b..41a22aa 100644
--- a/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c
+++ b/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c
@@ -620,6 +620,14 @@ LibAppendFileName (
Size1 = StrSize (Str1);
Size2 = StrSize (Str2);
+
+ //
+ // Check overflow
+ //
+ if (((MAX_UINTN - Size1) < Size2) || ((MAX_UINTN - Size1 - Size2) < sizeof(CHAR16))) {
+ return NULL;
+ }
+
MaxLen = (Size1 + Size2 + sizeof (CHAR16))/ sizeof (CHAR16);
Str = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
ASSERT (Str != NULL);
@@ -963,6 +971,7 @@ LibGetFileHandleFromDevicePath (
// the file system support below to be skipped.
//
Status = EFI_OUT_OF_RESOURCES;
+ goto Done;
}
//
@@ -992,6 +1001,11 @@ LibGetFileHandleFromDevicePath (
*ParentFileName = AllocateCopyPool (StrSize (((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName), ((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName);
} else {
TempPath = LibAppendFileName (*ParentFileName, ((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName);
+ if (TempPath == NULL) {
+ LastHandle->Close (LastHandle);
+ Status = EFI_OUT_OF_RESOURCES;
+ goto Done;
+ }
FreePool (*ParentFileName);
*ParentFileName = TempPath;
}
@@ -1067,12 +1081,14 @@ LibFindFiles (
// Pass 1 to get Directories
// Pass 2 to get files that are EFI images
//
+ Status = EFI_SUCCESS;
for (Pass = 1; Pass <= 2; Pass++) {
FileHandle->SetPosition (FileHandle, 0);
for (;;) {
BufferSize = DirBufferSize;
Status = FileHandle->Read (FileHandle, &BufferSize, DirInfo);
if (EFI_ERROR (Status) || BufferSize == 0) {
+ Status = EFI_SUCCESS;
break;
}
@@ -1095,12 +1111,18 @@ LibFindFiles (
NewMenuEntry = LibCreateMenuEntry ();
if (NULL == NewMenuEntry) {
- return EFI_OUT_OF_RESOURCES;
+ Status = EFI_OUT_OF_RESOURCES;
+ goto Done;
}
NewFileContext = (FILE_CONTEXT *) NewMenuEntry->VariableContext;
NewFileContext->DeviceHandle = DeviceHandle;
NewFileContext->FileName = LibAppendFileName (FileName, DirInfo->FileName);
+ if (NewFileContext->FileName == NULL) {
+ LibDestroyMenuEntry (NewMenuEntry);
+ Status = EFI_OUT_OF_RESOURCES;
+ goto Done;
+ }
NewFileContext->FileHandle = FileHandle;
NewFileContext->DevicePath = FileDevicePath (NewFileContext->DeviceHandle, NewFileContext->FileName);
NewMenuEntry->HelpString = NULL;
@@ -1135,9 +1157,11 @@ LibFindFiles (
gFileExplorerPrivate.FsOptionMenu->MenuNumber = OptionNumber;
+Done:
+
FreePool (DirInfo);
- return EFI_SUCCESS;
+ return Status;
}
/**
--
2.8.0.windows.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Patch] MdeModulePkg FileExplorerLib: Fix potential Integer Overflow.
2016-10-14 6:49 [Patch] MdeModulePkg FileExplorerLib: Fix potential Integer Overflow Liming Gao
@ 2016-10-14 12:18 ` Laszlo Ersek
0 siblings, 0 replies; 2+ messages in thread
From: Laszlo Ersek @ 2016-10-14 12:18 UTC (permalink / raw)
To: Liming Gao, edk2-devel
On 10/14/16 08:49, Liming Gao wrote:
> In function 'LibAppendFileName' of 'FileExplorer.c':
> "
> MaxLen = (Size1 + Size2 + sizeof (CHAR16))/ sizeof (CHAR16);
> "
> Overflow may happen here. MaxLen might become a very small number.
> This patch adds integer overflow checker.
>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Liming Gao <liming.gao@intel.com>
> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
> ---
> .../Library/FileExplorerLib/FileExplorer.c | 28 ++++++++++++++++++++--
> 1 file changed, 26 insertions(+), 2 deletions(-)
The first hunk of the patch looks good to me.
The rest of the patch may also be good, but what it does is logically
separate -- it eliminates resource leaks and fixes return values on
error paths. For that reason, it belongs to a different patch, I think;
something like:
MdeModulePkg FileExplorerLib: free resources and set retvals on errors
Thanks
Laszlo
> diff --git a/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c b/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c
> index 59c851b..41a22aa 100644
> --- a/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c
> +++ b/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c
> @@ -620,6 +620,14 @@ LibAppendFileName (
>
> Size1 = StrSize (Str1);
> Size2 = StrSize (Str2);
> +
> + //
> + // Check overflow
> + //
> + if (((MAX_UINTN - Size1) < Size2) || ((MAX_UINTN - Size1 - Size2) < sizeof(CHAR16))) {
> + return NULL;
> + }
> +
> MaxLen = (Size1 + Size2 + sizeof (CHAR16))/ sizeof (CHAR16);
> Str = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
> ASSERT (Str != NULL);
> @@ -963,6 +971,7 @@ LibGetFileHandleFromDevicePath (
> // the file system support below to be skipped.
> //
> Status = EFI_OUT_OF_RESOURCES;
> + goto Done;
> }
>
> //
> @@ -992,6 +1001,11 @@ LibGetFileHandleFromDevicePath (
> *ParentFileName = AllocateCopyPool (StrSize (((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName), ((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName);
> } else {
> TempPath = LibAppendFileName (*ParentFileName, ((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName);
> + if (TempPath == NULL) {
> + LastHandle->Close (LastHandle);
> + Status = EFI_OUT_OF_RESOURCES;
> + goto Done;
> + }
> FreePool (*ParentFileName);
> *ParentFileName = TempPath;
> }
> @@ -1067,12 +1081,14 @@ LibFindFiles (
> // Pass 1 to get Directories
> // Pass 2 to get files that are EFI images
> //
> + Status = EFI_SUCCESS;
> for (Pass = 1; Pass <= 2; Pass++) {
> FileHandle->SetPosition (FileHandle, 0);
> for (;;) {
> BufferSize = DirBufferSize;
> Status = FileHandle->Read (FileHandle, &BufferSize, DirInfo);
> if (EFI_ERROR (Status) || BufferSize == 0) {
> + Status = EFI_SUCCESS;
> break;
> }
>
> @@ -1095,12 +1111,18 @@ LibFindFiles (
>
> NewMenuEntry = LibCreateMenuEntry ();
> if (NULL == NewMenuEntry) {
> - return EFI_OUT_OF_RESOURCES;
> + Status = EFI_OUT_OF_RESOURCES;
> + goto Done;
> }
>
> NewFileContext = (FILE_CONTEXT *) NewMenuEntry->VariableContext;
> NewFileContext->DeviceHandle = DeviceHandle;
> NewFileContext->FileName = LibAppendFileName (FileName, DirInfo->FileName);
> + if (NewFileContext->FileName == NULL) {
> + LibDestroyMenuEntry (NewMenuEntry);
> + Status = EFI_OUT_OF_RESOURCES;
> + goto Done;
> + }
> NewFileContext->FileHandle = FileHandle;
> NewFileContext->DevicePath = FileDevicePath (NewFileContext->DeviceHandle, NewFileContext->FileName);
> NewMenuEntry->HelpString = NULL;
> @@ -1135,9 +1157,11 @@ LibFindFiles (
>
> gFileExplorerPrivate.FsOptionMenu->MenuNumber = OptionNumber;
>
> +Done:
> +
> FreePool (DirInfo);
>
> - return EFI_SUCCESS;
> + return Status;
> }
>
> /**
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-10-14 12:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-10-14 6:49 [Patch] MdeModulePkg FileExplorerLib: Fix potential Integer Overflow Liming Gao
2016-10-14 12:18 ` Laszlo Ersek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox