From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.65; helo=mga03.intel.com; envelope-from=jiaxin.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 30A70221ED768 for ; Mon, 25 Dec 2017 18:31:59 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 25 Dec 2017 18:36:52 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,458,1508828400"; d="scan'208";a="4840448" Received: from jiaxinwu-mobl2.ccr.corp.intel.com ([10.239.196.165]) by fmsmga002.fm.intel.com with ESMTP; 25 Dec 2017 18:36:50 -0800 From: Jiaxin Wu To: edk2-devel@lists.01.org Cc: Gary Lin , Ye Ting , Fu Siyuan , Wang Fan , Wu Jiaxin Date: Tue, 26 Dec 2017 10:36:47 +0800 Message-Id: <1514255807-4580-1-git-send-email-jiaxin.wu@intel.com> X-Mailer: git-send-email 1.9.5.msysgit.1 Subject: [Patch 1/5 v2] MdeModulePkg/DxeHttpLib: Add boundary condition check. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Dec 2017 02:31:59 -0000 v2: * Fix GCC the build error. This patch is to add the boundary condition check to make sure the accessed buffer is valid. Cc: Gary Lin Cc: Ye Ting Cc: Fu Siyuan Cc: Wang Fan Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin --- MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c | 38 +++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 4 deletions(-) diff --git a/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c b/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c index caddbb7..915b81d 100644 --- a/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c +++ b/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c @@ -54,11 +54,11 @@ UriPercentDecode ( Index = 0; Offset = 0; HexStr[2] = '\0'; while (Index < BufferLength) { if (Buffer[Index] == '%') { - if (!NET_IS_HEX_CHAR (Buffer[Index+1]) || !NET_IS_HEX_CHAR (Buffer[Index+2])) { + if (Index + 1 >= BufferLength || Index + 2 >= BufferLength || !NET_IS_HEX_CHAR (Buffer[Index+1]) || !NET_IS_HEX_CHAR (Buffer[Index+2])) { return EFI_INVALID_PARAMETER; } HexStr[0] = Buffer[Index+1]; HexStr[1] = Buffer[Index+2]; ResultBuffer[Offset] = (CHAR8) AsciiStrHexToUintn (HexStr); @@ -1556,20 +1556,31 @@ HttpGetFieldNameAndValue ( ) { CHAR8 *FieldNameStr; CHAR8 *FieldValueStr; CHAR8 *StrPtr; + CHAR8 *EndofHeader; if (String == NULL || FieldName == NULL || FieldValue == NULL) { return NULL; } *FieldName = NULL; *FieldValue = NULL; FieldNameStr = NULL; FieldValueStr = NULL; StrPtr = NULL; + EndofHeader = NULL; + + + // + // Check whether the raw HTTP header string is valid or not. + // + EndofHeader = AsciiStrStr (String, "\r\n\r\n"); + if (EndofHeader == NULL) { + return NULL; + } // // Each header field consists of a name followed by a colon (":") and the field value. // FieldNameStr = String; @@ -1583,17 +1594,36 @@ HttpGetFieldNameAndValue ( // *(FieldValueStr - 1) = 0; // // The field value MAY be preceded by any amount of LWS, though a single SP is preferred. + // Note: LWS = [CRLF] 1*(SP|HT), it can be '\r\n ' or '\r\n\t' or ' ' or '\t'. + // CRLF = '\r\n'. + // SP = ' '. + // HT = '\t' (Tab). // while (TRUE) { if (*FieldValueStr == ' ' || *FieldValueStr == '\t') { + // + // Boundary condition check. + // + if ((UINTN)EndofHeader - (UINTN)(FieldValueStr) < 1) { + return NULL; + } + FieldValueStr ++; - } else if (*FieldValueStr == '\r' && *(FieldValueStr + 1) == '\n' && - (*(FieldValueStr + 2) == ' ' || *(FieldValueStr + 2) == '\t')) { - FieldValueStr = FieldValueStr + 3; + } else if (*FieldValueStr == '\r') { + // + // Boundary condition check. + // + if ((UINTN)EndofHeader - (UINTN)(FieldValueStr) < 3) { + return NULL; + } + + if (*(FieldValueStr + 1) == '\n' && (*(FieldValueStr + 2) == ' ' || *(FieldValueStr + 2) == '\t')) { + FieldValueStr = FieldValueStr + 3; + } } else { break; } } -- 1.9.5.msysgit.1