From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.65, mailfrom: zhichao.gao@intel.com) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by groups.io with SMTP; Tue, 25 Jun 2019 22:32:03 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 25 Jun 2019 22:32:02 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,418,1557212400"; d="scan'208";a="183051307" Received: from fieedk001.ccr.corp.intel.com ([10.239.33.119]) by fmsmga001.fm.intel.com with ESMTP; 25 Jun 2019 22:32:01 -0700 From: "Gao, Zhichao" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Laszlo Ersek , Liming Gao Subject: [PATCH v3] UefiCpuPkg/MpInitLib: MicrocodeDetect: Ensure checked range is valid Date: Wed, 26 Jun 2019 13:31:58 +0800 Message-Id: <20190626053158.6060-1-zhichao.gao@intel.com> X-Mailer: git-send-email 2.21.0.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1934 0x0 MicrocodeBegin MicrocodeEntry MicrocodeEnd 0xffffffff |--------------|---------------|---------------|---------------| valid TotalSize TotalSize is only valid between 0 and (MicrocodeEnd - MicrocodeEntry). So add '(UINTN)MicrocodeEntryPoint > (MAX_ADDRESS - TotalSize)' before '((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd' to make sure ((UINTN)MicrocodeEntryPoint + TotalSize) wouldn't overflow. Cc: Eric Dong Cc: Ray Ni Cc: Laszlo Ersek Cc: Liming Gao Signed-off-by: Zhichao Gao --- UefiCpuPkg/Library/MpInitLib/Microcode.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/UefiCpuPkg/Library/MpInitLib/Microcode.c b/UefiCpuPkg/Library/MpInitLib/Microcode.c index 4763dcfebe..c30df58e5a 100644 --- a/UefiCpuPkg/Library/MpInitLib/Microcode.c +++ b/UefiCpuPkg/Library/MpInitLib/Microcode.c @@ -1,7 +1,7 @@ /** @file Implementation of loading microcode on processors. - Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.
+ Copyright (c) 2015 - 2019, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent **/ @@ -167,9 +167,15 @@ MicrocodeDetect ( } /// - /// Check overflow and whether TotalSize is aligned with 4 bytes. + /// 0x0 MicrocodeBegin MicrocodeEntry MicrocodeEnd 0xffffffff + /// |--------------|---------------|---------------|---------------| + /// valid TotalSize + /// TotalSize is only valid between 0 and (MicrocodeEnd - MicrocodeEntry). + /// And it should be aligned with 4 bytes. + /// If the TotalSize is invalid skip 1KB the check next entry. /// - if ( ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd || + if ( (UINTN)MicrocodeEntryPoint > (MAX_ADDRESS - TotalSize) || + ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd || (TotalSize & 0x3) != 0 ) { MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN) MicrocodeEntryPoint) + SIZE_1KB); -- 2.21.0.windows.1