From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.61]) by mx.groups.io with SMTP id smtpd.web11.981.1581618581930657887 for ; Thu, 13 Feb 2020 10:29:42 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=N6ZMuhv1; spf=pass (domain: redhat.com, ip: 205.139.110.61, mailfrom: philmd@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1581618581; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1tZ3dKWT5WVnfwFZe3rVUK9jv47S8RXv3bI+64b6z84=; b=N6ZMuhv11eVZ5F6zWBtCtLQMl5YojExNruspsEN+gf5MpbDFCqvbVENElp6Ob66KsXcdGu PaQOPtUqQlE/6ArBQys1/oASyFWxbMGqCX/BSVS5iJ0a+SmCVMCymcUFoHZbDDzZwyf5vM zsfeURE85Bkg/8vQVedtK4vj6FcsXVU= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-294-q_g0tYIjNduwwZ56yQvtFg-1; Thu, 13 Feb 2020 13:29:39 -0500 Received: by mail-wm1-f69.google.com with SMTP id a189so2338800wme.2 for ; Thu, 13 Feb 2020 10:29:38 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=s6Bs+Bf0aAfNSJwhxtVPzbTSvh8NYdWfyIm3w00Vw20=; b=SKX3ByZjeCrNx1PqltnW3qebr2fu2BAMLPP0iC+RJk1Wzzzj5tFdTJHWtKIduDscS7 Ot3klB2KKivEB8+LrA+1b40nJKwYl+Apl5YDXDxmZfZGQ4YrYwg6SBSdR3M0Ec0Ee8up rBl4c3M+jzbv4F/FvAYfFSA6Ln/gXjmsB77qpKH1+vb15pFifMs8esqcd/kPTpPSsjVZ yYkm9PkKRrrknr/WpvaLwZffxdBE/wUkmmuI8baLPgV4Ue/Nfbz45UkV05cX0QqEztSk YqSOj7t9RrbtQWg2ACUVlGtxw1bOqSy/FcR2HAkyeq4bwPr76jwBLuyqMzLJGx6dSdyO YOZg== X-Gm-Message-State: APjAAAVzEI4f3TmutM2n0DBKrwwWbPUFiYYPKScLAIyFGNk95XN2Ub4i SrkfRj0pIHnMRGeKP1MginizFRXH2048jMlVgVSm+0Uz+ID8u+h/odGPiYIC5+5pzHPSRCBY+oX nuLdb6qldchQZkQ== X-Received: by 2002:a1c:ba83:: with SMTP id k125mr7132805wmf.106.1581618577623; Thu, 13 Feb 2020 10:29:37 -0800 (PST) X-Google-Smtp-Source: APXvYqxAEZqvvC5OF86GKZc9C39B3N/vMPdi7yoL4vFOqnDtmMNnr9zEr8oZEtzhxiNhi1Fm6qA8PA== X-Received: by 2002:a1c:ba83:: with SMTP id k125mr7132784wmf.106.1581618577343; Thu, 13 Feb 2020 10:29:37 -0800 (PST) Return-Path: Received: from x1w.redhat.com (78.red-88-21-202.staticip.rima-tde.net. [88.21.202.78]) by smtp.gmail.com with ESMTPSA id d22sm3927229wmd.39.2020.02.13.10.29.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Feb 2020 10:29:36 -0800 (PST) From: =?UTF-8?B?UGhpbGlwcGUgTWF0aGlldS1EYXVkw6k=?= To: devel@edk2.groups.io Cc: Philippe Mathieu-Daude , Jian J Wang , Hao A Wu , Eric Dong , Laszlo Ersek Subject: [RFC PATCH 0/1] MdeModulePkg/PiDxeS3BootScriptLib: Use SafeIntLib to avoid truncation Date: Thu, 13 Feb 2020 19:29:34 +0100 Message-Id: <20200213182935.26663-1-philmd@redhat.com> X-Mailer: git-send-email 2.21.1 MIME-Version: 1.0 X-MC-Unique: q_g0tYIjNduwwZ56yQvtFg-1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Commit 322ac05f8bbc added truncation checks to fix CVE-2019-14563. I found the 'a * b > d - c' reverse notation not obvious to review, and suggested to write 'a * b + c > d'. Laszlo explained me this is the EDK2 standard pattern to check against each overflow, but pointed out the SafeIntLib which have pretty readable calls. This is my try at using it. Regards, Phil. Cc: Jian J Wang Cc: Hao A Wu Cc: Eric Dong Cc: Laszlo Ersek Philippe Mathieu-Daud=C3=A9 (1): MdeModulePkg/PiDxeS3BootScriptLib: Use SafeIntLib to avoid truncation .../DxeS3BootScriptLib.inf | 1 + .../InternalBootScriptLib.h | 1 + .../PiDxeS3BootScriptLib/BootScriptSave.c | 114 +++++++++++------- 3 files changed, 73 insertions(+), 43 deletions(-) --=20 2.21.1