From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=pass header.i=@armh.onmicrosoft.com header.s=selector2-armh-onmicrosoft-com header.b=Mq/BkPpy; spf=pass (domain: arm.com, ip: 40.107.3.46, mailfrom: krzysztof.koch@arm.com) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (EUR03-AM5-obe.outbound.protection.outlook.com [40.107.3.46]) by groups.io with SMTP; Mon, 22 Jul 2019 00:53:26 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=B/Jl3drFcSjH+DfAyWfGcALZKxvt/exF0aV7mVLJwbC3x19vlTl8VN+D08BQKZXG/FG3xpat3Eg/2UPiUzUfAMi8M9yfW1c7VfTzMbssuRJUZ4AfI2kv3xR12yfzU9XclzxUi1amDv78pcHEThfLI/3Ej95jfya/QYkt2br06Pjbzvzh4dJOieJNR3PNw2YTz2HIuyqO21gue7tBFOGkE2h8A06pbwNNcKAiJ1KNq35Hvy/pQUDiFIkMjGFrHRmmFm6YlJieJ4hKLXO8Hbd1ZpUl4WTz1mCl1TGrw96RNcIEKZwNp3bzYnmREBgHNN0/dcDE7gEtV01YAAdTb63MpQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ODUJFB15+/7wSpoxlcTZvpHFai9hOSqSZr8HjDWDvAE=; b=kihYdLuMRNjpC1AeV9msFcAtlWX12cmpNWhUs7GT1CXtzFOI1/XF+eDqBpvfehhl8R/3uMMGLE4CoJTGHdI7zZuL6i2fPGGIqnFSA46ryAnBcyS6P2T7a3SRgLwI8zv8SvUDOqiUvSOmcmo9HtP9z52QkTyp5hby1NDIR5rEiO3ZfofxvtB/gJuu3p0D/5si2jDbEddXH3QcGfQmYAdfssCXnywgh6ejAZjU8uIgP4uPkcXax+07txhWX7lLZw6toD3gKGpzBXfdKe/ir6hrCuDAGnj5cQcxXjci3c06vZyzt2QJQVI+CNLTnHklc6e0J3vEm5iQ9Byn3OPPInvUlA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=temperror (sender ip is 40.67.248.234) smtp.rcpttodomain=edk2.groups.io smtp.mailfrom=arm.com;dmarc=temperror action=none header.from=arm.com;dkim=none (message not signed);arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ODUJFB15+/7wSpoxlcTZvpHFai9hOSqSZr8HjDWDvAE=; b=Mq/BkPpy88MLyjrvxIjqOtdd4gAUgKSGSJlg75H9WZpcK8Op10YJtxLDZI9mVG2WE8+d0QGrrzP+ocyZklCX/K2PxWUZDm8RbQjQhFhapW8SSWhx3xYGVrYH2DEDk+4WLi9X81XNQkKXZKYdZvG8J08aWCSPOXEjXVVnTvfHxbI= Received: from VI1PR0802CA0047.eurprd08.prod.outlook.com (10.172.253.33) by AM5PR0802MB2596.eurprd08.prod.outlook.com (10.175.41.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Mon, 22 Jul 2019 07:53:21 +0000 Received: from DB5EUR03FT059.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e0a::206) by VI1PR0802CA0047.outlook.office365.com (2603:10a6:800:a9::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2094.11 via Frontend Transport; Mon, 22 Jul 2019 07:53:21 +0000 Authentication-Results: spf=temperror (sender IP is 40.67.248.234) smtp.mailfrom=arm.com; edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from nebula.arm.com (40.67.248.234) by DB5EUR03FT059.mail.protection.outlook.com (10.152.21.175) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2052.18 via Frontend Transport; Mon, 22 Jul 2019 07:53:20 +0000 Received: from AZ-NEU-EX04.Arm.com (10.251.24.32) by AZ-NEU-EX04.Arm.com (10.251.24.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1415.2; Mon, 22 Jul 2019 07:50:37 +0000 Received: from E119924.Arm.com (10.1.199.124) by mail.arm.com (10.251.24.32) with Microsoft SMTP Server id 15.1.1415.2 via Frontend Transport; Mon, 22 Jul 2019 07:50:37 +0000 From: "Krzysztof Koch" To: CC: , , , , , Subject: [PATCH v2 5/6] ShellPkg: acpiview: MADT: Split structure length validation Date: Mon, 22 Jul 2019 08:50:25 +0100 Message-ID: <20190722075026.20244-6-krzysztof.koch@arm.com> X-Mailer: git-send-email 2.16.2.windows.1 In-Reply-To: <20190722075026.20244-1-krzysztof.koch@arm.com> References: <20190722075026.20244-1-krzysztof.koch@arm.com> Return-Path: Krzysztof.Koch@arm.com MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:40.67.248.234;IPV:NLI;CTRY:IE;EFV:NLI;SFV:NSPM;SFS:(10009020)(4636009)(396003)(136003)(376002)(346002)(39860400002)(2980300002)(199004)(189003)(336012)(6916009)(16586007)(50226002)(2906002)(53936002)(316002)(486006)(54906003)(2351001)(81156014)(26005)(81166006)(126002)(76176011)(53416004)(44832011)(186003)(8936002)(8676002)(51416003)(7696005)(4326008)(6666004)(1076003)(50466002)(86362001)(48376002)(305945005)(446003)(5660300002)(426003)(63370400001)(63350400001)(476003)(70206006)(36756003)(2616005)(68736007)(356004)(478600001)(47776003)(11346002)(70586007);DIR:OUT;SFP:1101;SCL:1;SRVR:AM5PR0802MB2596;H:nebula.arm.com;FPR:;SPF:TempError;LANG:en;PTR:InfoDomainNonexistent;A:1;MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 27cc271c-a872-4913-db00-08d70e79a9ed X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328);SRVR:AM5PR0802MB2596; X-MS-TrafficTypeDiagnostic: AM5PR0802MB2596: X-Microsoft-Antispam-PRVS: NoDisclaimer: True X-MS-Oob-TLC-OOBClassifiers: OLM:3826; X-Forefront-PRVS: 01068D0A20 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info: 5Yo6IPB3s4MjSXn3BqaLLDqaLMV64306p+OSEhJ+f+XmWp7NnRVFrYCPsFmnC1OmA20pu7R25GrWBagLClVDIRjYQx5FdXbgqNotkXdWG+cJipYTqyy81+V9iWIL7gsOQC6zLFl2cvNn2fj/ScyDNU6vkL6wkXMDsW4UkrJu+pUfTHbPUkCm0qJX1RDe0RQqmFeMBgUBYW3W4uajjQlr+CIQbmr/yNky/CPjjBK3v/+8/7xYXjlDbcDIBr4agR3G2GirGP7kYVsm9lSLuZ5ywI+JrQ1sJhN8epFFlp2XfhvM7/5hYhYd4iqg1VRYKDW8RRp1UKho5KVufd+zKhPt03QVTOb/MopzGVUjmHQDR0VG5qClxrgDVSvwGqQhWsRbYmEsO8hNCvACCxEMLuG+Xa+dXL8mbMFZ+SdayDkYE08= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2019 07:53:20.0851 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 27cc271c-a872-4913-db00-08d70e79a9ed X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d;Ip=[40.67.248.234];Helo=[nebula.arm.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0802MB2596 Content-Type: text/plain Split the Interrupt Controller Structure length validation in the acpiview UEFI shell tool into two logical parts: 1. Ensuring MADT table parser forward progress. 2. Preventing MADT table buffer overruns. Also, make the condition for infinite loop detection applicable to all types of Interrupt Controller Structures (for all interrupt models which can be represented in MADT). Check if the controller length specified is shorter than the byte size of the first two fields ('Type' and 'Length') present in every valid Interrupt Controller Structure. Signed-off-by: Krzysztof Koch --- Notes: v1: - split MADT structure length validation [Krzysztof] ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c | 30 ++++++++++++++------ 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c index 338295d30e35c366a60505225cf57145a8e73d93..d80ebd1a2bae7a4acffe687ca5ee7b4090f0e223 100644 --- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c +++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c @@ -260,16 +260,30 @@ ParseAcpiMadt ( PARSER_PARAMS (MadtInterruptControllerHeaderParser) ); - if (((Offset + (*MadtInterruptControllerLength)) > AcpiTableLength) || - (*MadtInterruptControllerLength < 4)) { + // Make sure forward progress is made. + if (*MadtInterruptControllerLength < 2) { IncrementErrorCount (); Print ( - L"ERROR: Invalid Interrupt Controller Length," - L" Type = %d, Length = %d\n", - *MadtInterruptControllerType, - *MadtInterruptControllerLength - ); - break; + L"ERROR: Structure length is too small: " \ + L"MadtInterruptControllerLength = %d. " \ + L"MadtInterruptControllerType = %d. MADT parsing aborted.\n", + *MadtInterruptControllerLength, + *MadtInterruptControllerType + ); + return; + } + + // Make sure the MADT structure lies inside the table + if ((Offset + *MadtInterruptControllerLength) > AcpiTableLength) { + IncrementErrorCount (); + Print ( + L"ERROR: Invalid MADT structure length. " \ + L"MadtInterruptControllerLength = %d. " \ + L"RemainingTableBufferLength = %d. MADT parsing aborted.\n", + *MadtInterruptControllerLength, + AcpiTableLength - Offset + ); + return; } switch (*MadtInterruptControllerType) { -- 'Guid(CE165669-3EF3-493F-B85D-6190EE5B9759)'