* [Patch] BaseTools: Fix Section header size larger than elf file size bug
@ 2018-06-07 2:08 Yonghong Zhu
2018-06-08 3:38 ` Gao, Liming
0 siblings, 1 reply; 2+ messages in thread
From: Yonghong Zhu @ 2018-06-07 2:08 UTC (permalink / raw)
To: edk2-devel; +Cc: Yunhua Feng, Liming Gao
From: Yunhua Feng <yunhuax.feng@intel.com>
Add the logic to handle the case that Section header size larger than
elf file size.
Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yunhua Feng <yunhuax.feng@intel.com>
---
BaseTools/Source/C/GenFw/Elf32Convert.c | 3 +++
BaseTools/Source/C/GenFw/Elf64Convert.c | 3 +++
BaseTools/Source/C/GenFw/ElfConvert.c | 20 ++++++++++++++++----
BaseTools/Source/C/GenFw/ElfConvert.h | 3 ++-
4 files changed, 24 insertions(+), 5 deletions(-)
diff --git a/BaseTools/Source/C/GenFw/Elf32Convert.c b/BaseTools/Source/C/GenFw/Elf32Convert.c
index e0f6491..e26b10b 100644
--- a/BaseTools/Source/C/GenFw/Elf32Convert.c
+++ b/BaseTools/Source/C/GenFw/Elf32Convert.c
@@ -672,10 +672,13 @@ WriteSections32 (
Elf_Shdr *Shdr = GetShdrByIndex(Idx);
if ((*Filter)(Shdr)) {
switch (Shdr->sh_type) {
case SHT_PROGBITS:
/* Copy. */
+ if (Shdr->sh_offset + Shdr->sh_size > mFileBufferSize) {
+ return FALSE;
+ }
memcpy(mCoffFile + mCoffSectionsOffset[Idx],
(UINT8*)mEhdr + Shdr->sh_offset,
Shdr->sh_size);
break;
diff --git a/BaseTools/Source/C/GenFw/Elf64Convert.c b/BaseTools/Source/C/GenFw/Elf64Convert.c
index 9e68d22..cc0c2cf 100644
--- a/BaseTools/Source/C/GenFw/Elf64Convert.c
+++ b/BaseTools/Source/C/GenFw/Elf64Convert.c
@@ -668,10 +668,13 @@ WriteSections64 (
Elf_Shdr *Shdr = GetShdrByIndex(Idx);
if ((*Filter)(Shdr)) {
switch (Shdr->sh_type) {
case SHT_PROGBITS:
/* Copy. */
+ if (Shdr->sh_offset + Shdr->sh_size > mFileBufferSize) {
+ return FALSE;
+ }
memcpy(mCoffFile + mCoffSectionsOffset[Idx],
(UINT8*)mEhdr + Shdr->sh_offset,
(size_t) Shdr->sh_size);
break;
diff --git a/BaseTools/Source/C/GenFw/ElfConvert.c b/BaseTools/Source/C/GenFw/ElfConvert.c
index 17913ff..6844c69 100644
--- a/BaseTools/Source/C/GenFw/ElfConvert.c
+++ b/BaseTools/Source/C/GenFw/ElfConvert.c
@@ -1,9 +1,9 @@
/** @file
Elf convert solution
-Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials are licensed and made available
under the terms and conditions of the BSD License which accompanies this
distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
@@ -56,10 +56,15 @@ UINT32 mCoffOffset;
// Offset in Coff file of headers and sections.
//
UINT32 mTableOffset;
//
+//mFileBufferSize
+//
+UINT32 mFileBufferSize;
+
+//
//*****************************************************************************
// Common ELF Functions
//*****************************************************************************
//
@@ -171,10 +176,11 @@ ConvertElf (
)
{
ELF_FUNCTION_TABLE ElfFunctions;
UINT8 EiClass;
+ mFileBufferSize = *FileLength;
//
// Determine ELF type and set function table pointer correctly.
//
VerboseMsg ("Check Elf Image Header");
EiClass = (*FileBuffer)[EI_CLASS];
@@ -199,13 +205,19 @@ ConvertElf (
//
// Write and relocate sections.
//
VerboseMsg ("Write and relocate sections.");
- ElfFunctions.WriteSections (SECTION_TEXT);
- ElfFunctions.WriteSections (SECTION_DATA);
- ElfFunctions.WriteSections (SECTION_HII);
+ if (!ElfFunctions.WriteSections (SECTION_TEXT)) {
+ return FALSE;
+ }
+ if (!ElfFunctions.WriteSections (SECTION_DATA)) {
+ return FALSE;
+ }
+ if (!ElfFunctions.WriteSections (SECTION_HII)) {
+ return FALSE;
+ }
//
// Translate and write relocations.
//
VerboseMsg ("Translate and write relocations.");
diff --git a/BaseTools/Source/C/GenFw/ElfConvert.h b/BaseTools/Source/C/GenFw/ElfConvert.h
index abf434d..fc8c63f 100644
--- a/BaseTools/Source/C/GenFw/ElfConvert.h
+++ b/BaseTools/Source/C/GenFw/ElfConvert.h
@@ -1,9 +1,9 @@
/** @file
Header file for Elf convert solution
-Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials are licensed and made available
under the terms and conditions of the BSD License which accompanies this
distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
@@ -27,10 +27,11 @@ extern UINT32 mCoffOffset;
extern CHAR8 *mInImageName;
extern UINT32 mImageTimeStamp;
extern UINT8 *mCoffFile;
extern UINT32 mTableOffset;
extern UINT32 mOutImageType;
+extern UINT32 mFileBufferSize;
//
// Common EFI specific data.
//
#define ELF_HII_SECTION_NAME ".hii"
--
2.6.1.windows.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Patch] BaseTools: Fix Section header size larger than elf file size bug
2018-06-07 2:08 [Patch] BaseTools: Fix Section header size larger than elf file size bug Yonghong Zhu
@ 2018-06-08 3:38 ` Gao, Liming
0 siblings, 0 replies; 2+ messages in thread
From: Gao, Liming @ 2018-06-08 3:38 UTC (permalink / raw)
To: Zhu, Yonghong, edk2-devel@lists.01.org; +Cc: Feng, YunhuaX
Reviewed-by: Liming Gao <liming.gao@intel.com>
> -----Original Message-----
> From: Zhu, Yonghong
> Sent: Thursday, June 7, 2018 10:09 AM
> To: edk2-devel@lists.01.org
> Cc: Feng, YunhuaX <yunhuax.feng@intel.com>; Gao, Liming <liming.gao@intel.com>
> Subject: [Patch] BaseTools: Fix Section header size larger than elf file size bug
>
> From: Yunhua Feng <yunhuax.feng@intel.com>
>
> Add the logic to handle the case that Section header size larger than
> elf file size.
>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Yonghong Zhu <yonghong.zhu@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Yunhua Feng <yunhuax.feng@intel.com>
> ---
> BaseTools/Source/C/GenFw/Elf32Convert.c | 3 +++
> BaseTools/Source/C/GenFw/Elf64Convert.c | 3 +++
> BaseTools/Source/C/GenFw/ElfConvert.c | 20 ++++++++++++++++----
> BaseTools/Source/C/GenFw/ElfConvert.h | 3 ++-
> 4 files changed, 24 insertions(+), 5 deletions(-)
>
> diff --git a/BaseTools/Source/C/GenFw/Elf32Convert.c b/BaseTools/Source/C/GenFw/Elf32Convert.c
> index e0f6491..e26b10b 100644
> --- a/BaseTools/Source/C/GenFw/Elf32Convert.c
> +++ b/BaseTools/Source/C/GenFw/Elf32Convert.c
> @@ -672,10 +672,13 @@ WriteSections32 (
> Elf_Shdr *Shdr = GetShdrByIndex(Idx);
> if ((*Filter)(Shdr)) {
> switch (Shdr->sh_type) {
> case SHT_PROGBITS:
> /* Copy. */
> + if (Shdr->sh_offset + Shdr->sh_size > mFileBufferSize) {
> + return FALSE;
> + }
> memcpy(mCoffFile + mCoffSectionsOffset[Idx],
> (UINT8*)mEhdr + Shdr->sh_offset,
> Shdr->sh_size);
> break;
>
> diff --git a/BaseTools/Source/C/GenFw/Elf64Convert.c b/BaseTools/Source/C/GenFw/Elf64Convert.c
> index 9e68d22..cc0c2cf 100644
> --- a/BaseTools/Source/C/GenFw/Elf64Convert.c
> +++ b/BaseTools/Source/C/GenFw/Elf64Convert.c
> @@ -668,10 +668,13 @@ WriteSections64 (
> Elf_Shdr *Shdr = GetShdrByIndex(Idx);
> if ((*Filter)(Shdr)) {
> switch (Shdr->sh_type) {
> case SHT_PROGBITS:
> /* Copy. */
> + if (Shdr->sh_offset + Shdr->sh_size > mFileBufferSize) {
> + return FALSE;
> + }
> memcpy(mCoffFile + mCoffSectionsOffset[Idx],
> (UINT8*)mEhdr + Shdr->sh_offset,
> (size_t) Shdr->sh_size);
> break;
>
> diff --git a/BaseTools/Source/C/GenFw/ElfConvert.c b/BaseTools/Source/C/GenFw/ElfConvert.c
> index 17913ff..6844c69 100644
> --- a/BaseTools/Source/C/GenFw/ElfConvert.c
> +++ b/BaseTools/Source/C/GenFw/ElfConvert.c
> @@ -1,9 +1,9 @@
> /** @file
> Elf convert solution
>
> -Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>
> +Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
>
> This program and the accompanying materials are licensed and made available
> under the terms and conditions of the BSD License which accompanies this
> distribution. The full text of the license may be found at
> http://opensource.org/licenses/bsd-license.php
> @@ -56,10 +56,15 @@ UINT32 mCoffOffset;
> // Offset in Coff file of headers and sections.
> //
> UINT32 mTableOffset;
>
> //
> +//mFileBufferSize
> +//
> +UINT32 mFileBufferSize;
> +
> +//
> //*****************************************************************************
> // Common ELF Functions
> //*****************************************************************************
> //
>
> @@ -171,10 +176,11 @@ ConvertElf (
> )
> {
> ELF_FUNCTION_TABLE ElfFunctions;
> UINT8 EiClass;
>
> + mFileBufferSize = *FileLength;
> //
> // Determine ELF type and set function table pointer correctly.
> //
> VerboseMsg ("Check Elf Image Header");
> EiClass = (*FileBuffer)[EI_CLASS];
> @@ -199,13 +205,19 @@ ConvertElf (
>
> //
> // Write and relocate sections.
> //
> VerboseMsg ("Write and relocate sections.");
> - ElfFunctions.WriteSections (SECTION_TEXT);
> - ElfFunctions.WriteSections (SECTION_DATA);
> - ElfFunctions.WriteSections (SECTION_HII);
> + if (!ElfFunctions.WriteSections (SECTION_TEXT)) {
> + return FALSE;
> + }
> + if (!ElfFunctions.WriteSections (SECTION_DATA)) {
> + return FALSE;
> + }
> + if (!ElfFunctions.WriteSections (SECTION_HII)) {
> + return FALSE;
> + }
>
> //
> // Translate and write relocations.
> //
> VerboseMsg ("Translate and write relocations.");
> diff --git a/BaseTools/Source/C/GenFw/ElfConvert.h b/BaseTools/Source/C/GenFw/ElfConvert.h
> index abf434d..fc8c63f 100644
> --- a/BaseTools/Source/C/GenFw/ElfConvert.h
> +++ b/BaseTools/Source/C/GenFw/ElfConvert.h
> @@ -1,9 +1,9 @@
> /** @file
> Header file for Elf convert solution
>
> -Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>
> +Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
>
> This program and the accompanying materials are licensed and made available
> under the terms and conditions of the BSD License which accompanies this
> distribution. The full text of the license may be found at
> http://opensource.org/licenses/bsd-license.php
> @@ -27,10 +27,11 @@ extern UINT32 mCoffOffset;
> extern CHAR8 *mInImageName;
> extern UINT32 mImageTimeStamp;
> extern UINT8 *mCoffFile;
> extern UINT32 mTableOffset;
> extern UINT32 mOutImageType;
> +extern UINT32 mFileBufferSize;
>
> //
> // Common EFI specific data.
> //
> #define ELF_HII_SECTION_NAME ".hii"
> --
> 2.6.1.windows.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-06-08 3:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-06-07 2:08 [Patch] BaseTools: Fix Section header size larger than elf file size bug Yonghong Zhu
2018-06-08 3:38 ` Gao, Liming
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox