From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f66.google.com (mail-wm1-f66.google.com [209.85.128.66]) by mx.groups.io with SMTP id smtpd.web11.6501.1573143693695522771 for ; Thu, 07 Nov 2019 08:21:34 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@linaro.org header.s=google header.b=JiJKNMRk; spf=pass (domain: linaro.org, ip: 209.85.128.66, mailfrom: leif.lindholm@linaro.org) Received: by mail-wm1-f66.google.com with SMTP id z26so3134225wmi.4 for ; Thu, 07 Nov 2019 08:21:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=gyQfA3T580+oKrpb3ceO7/AoTdk6RCnvLX9A5ax7WrA=; b=JiJKNMRkIUSz8ggpqT7TOd7gC8AoYfHKX3JXqW4kgRg9djOwkxPR5uCj1YYpdOeNGP p8lW7G0CM2OxW8DTcigeYeHfbk3nelYJeCwCQA8y9s6ltGxQ0OSDFj9ieqbd37Q7MUhh +N2WwprY7TtD7x4eZzLq7wbSNXJlcHpGLHQRRP8g7FpXfMwwwnq6iWM3tAxfILOJ1fC+ IJaKjDL+DN4+EzHEUKn0Jf6BGu6XhmG74xQnYWhzUzzmUmg5OZaB982QtnjXmBsOVUM8 +zfdh+OXfZCkjzCJuIinaOfncwwoyJBU8a6J5PnUw2N3qcPa25s24W9SIgM/w+X5511X ydvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=gyQfA3T580+oKrpb3ceO7/AoTdk6RCnvLX9A5ax7WrA=; b=Ywg2KKQ8HX6/Y/eXT7R3VVAW9VH5G+xQv7thwazs8x/yTxBb9Erv7o0ZbrnJccTj06 g3eliuEoqaXHlUdBf1enCgWoSgXRDkbjul/P8r1w6oh65FHjhQUoXdDVjUexnkDcxCwh YE6vZPJqbDdT3/pysVD8A9VxGshIULBUo5LPBnrUeAv9mwzTNGrM62f/ZX49NH1pWgog GE4QRUsiQmbjAcBYHD4jHBrDEjBK7kwKTq73ff/L1qXjheYMeipoNtPiI/7+u1pDFC5l EXDbgGfnaWEKmKfLzdaokMSGHZJqLSiLxnJ1rA/5Dl5LJYAfdnOb49oDMyUhucC2s6Pm 4HuQ== X-Gm-Message-State: APjAAAVJmdp4NVd7KYqgcNJdNN8FvJyt1vfGKmNr8mCkc/cNMEz9/jxd 2n4+ZemEhJecVIvoY1XkacO23Q== X-Google-Smtp-Source: APXvYqx/oqkNqIiRGciGJa7LvSMhmsXiSzmWDdjvR+Jj4E5lc5JIAZ+Rp2NvAFHwAkOETbQ1VXbZig== X-Received: by 2002:a05:600c:2257:: with SMTP id a23mr3943698wmm.143.1573143692265; Thu, 07 Nov 2019 08:21:32 -0800 (PST) Return-Path: Received: from bivouac.eciton.net (bivouac.eciton.net. [2a00:1098:0:86:1000:23:0:2]) by smtp.gmail.com with ESMTPSA id m3sm2674658wrw.20.2019.11.07.08.21.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 07 Nov 2019 08:21:31 -0800 (PST) Date: Thu, 7 Nov 2019 16:21:30 +0000 From: "Leif Lindholm" To: Pete Batard Cc: devel@edk2.groups.io, ard.biesheuvel@linaro.org, philmd@redhat.com Subject: Re: [edk2-platforms][PATCH 1/1] Platform/RPi: Prevent buffer over-read when the command line is empty Message-ID: <20191107162130.GQ16820@bivouac.eciton.net> References: <20191104160617.11036-1-pete@akeo.ie> MIME-Version: 1.0 In-Reply-To: <20191104160617.11036-1-pete@akeo.ie> User-Agent: Mutt/1.10.1 (2018-07-13) Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Patch looks good, but the term "command line" is a bit confusing. I assume we're talking about whatever way parameters are passed from pre-edk2 firmware to edk2, right? Is there a more precise term for this? / Leif On Mon, Nov 04, 2019 at 04:06:17PM +0000, Pete Batard wrote: > From: Andrei Warkentin > > It is possible for the command line to be empty > (Cmd->TagHead.TagValueSize = 0), in which case the code should not > attempt to read the value at CommandLine[-1]. > > Signed-off-by: Pete Batard > --- > Platform/RaspberryPi/Drivers/RpiFirmwareDxe/RpiFirmwareDxe.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/Platform/RaspberryPi/Drivers/RpiFirmwareDxe/RpiFirmwareDxe.c b/Platform/RaspberryPi/Drivers/RpiFirmwareDxe/RpiFirmwareDxe.c > index 5a9d4c3f1787..9b4aa068857c 100644 > --- a/Platform/RaspberryPi/Drivers/RpiFirmwareDxe/RpiFirmwareDxe.c > +++ b/Platform/RaspberryPi/Drivers/RpiFirmwareDxe/RpiFirmwareDxe.c > @@ -927,7 +927,8 @@ RpiFirmwareGetCommmandLine ( > > CopyMem (CommandLine, Cmd->CommandLine, Cmd->TagHead.TagValueSize); > > - if (CommandLine[Cmd->TagHead.TagValueSize - 1] != '\0') { > + if (Cmd->TagHead.TagValueSize == 0 || > + CommandLine[Cmd->TagHead.TagValueSize - 1] != '\0') { > // > // Add a NUL terminator if required. > // > -- > 2.21.0.windows.1 >