From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.groups.io with SMTP id smtpd.web09.11417.1623154401391319116 for ; Tue, 08 Jun 2021 05:13:21 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=IMLCcq7H; spf=pass (domain: redhat.com, ip: 170.10.133.124, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1623154400; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UN0XQSm5SXSxLmwi2f5imGJ65BGSfzvnWOtE/HJrJBs=; b=IMLCcq7Hkea/pbBO/DH4awrr8IKF7NN03W435xRzWHQbgRNWzah56n28yEwpUU91pc/tH/ kn7XdJkydgBSQDvAuy4MmWWjskPmhNK0B6dJPcbMVIr2KpEtlPPnDR5zM1asrfH+HJNQrd 6rUfyCamEHG3qmhrm68yLUIu+Ytqec4= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-592-ncjdOmQrPrGPmg0_gArunw-1; Tue, 08 Jun 2021 08:13:17 -0400 X-MC-Unique: ncjdOmQrPrGPmg0_gArunw-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 3ACDC8030A0; Tue, 8 Jun 2021 12:13:16 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-113-27.ams2.redhat.com [10.36.113.27]) by smtp.corp.redhat.com (Postfix) with ESMTP id 044486A83C; Tue, 8 Jun 2021 12:13:14 +0000 (UTC) From: "Laszlo Ersek" To: edk2-devel-groups-io Cc: Jiaxin Wu , Maciej Rabeda , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Siyuan Fu Subject: [PUBLIC edk2 PATCH v2 09/10] NetworkPkg/IScsiDxe: fix IScsiHexToBin() buffer overflow Date: Tue, 8 Jun 2021 14:12:58 +0200 Message-Id: <20210608121259.32451-10-lersek@redhat.com> In-Reply-To: <20210608121259.32451-1-lersek@redhat.com> References: <20210608121259.32451-1-lersek@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lersek@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 VGhlIElTY3NpSGV4VG9CaW4oKSBmdW5jdGlvbiBkb2N1bWVudHMgdGhlIEVGSV9CVUZGRVJfVE9P X1NNQUxMIHJldHVybgpjb25kaXRpb24sIGJ1dCBuZXZlciBhY3R1YWxseSBjaGVja3Mgd2hldGhl ciB0aGUgZGVjb2RlZCBidWZmZXIgZml0cyBpbnRvCnRoZSBjYWxsZXItcHJvdmlkZWQgcm9vbSAo aS5lLiwgdGhlIGlucHV0IHZhbHVlIG9mICJCaW5MZW5ndGgiKSwgYW5kCkVGSV9CVUZGRVJfVE9P X1NNQUxMIGlzIG5ldmVyIHJldHVybmVkLiBUaGUgZGVjb2Rpbmcgb2YgIkhleFN0ciIgY2FuCm92 ZXJmbG93ICJCaW5CdWZmZXIiLgoKVGhpcyBpcyByZW1vdGVseSBleHBsb2l0YWJsZSwgYXMgc2hv d24gaW4gYSBzdWJzZXF1ZW50IHBhdGNoLCB3aGljaCBhZGRzCmVycm9yIGNoZWNraW5nIHRvIHRo ZSBJU2NzaUhleFRvQmluKCkgY2FsbCBzaXRlcy4gVGhpcyBpc3N1ZSBhbGxvd3MgdGhlCnRhcmdl dCB0byBjb21wcm9taXNlIHRoZSBpbml0aWF0b3IuCgpJbnRyb2R1Y2UgRUZJX0JBRF9CVUZGRVJf U0laRSwgaW4gYWRkaXRpb24gdG8gdGhlIGV4aXN0ZW50CkVGSV9CVUZGRVJfVE9PX1NNQUxMLCBm b3IgcmVwb3J0aW5nIGEgc3BlY2lhbCBjYXNlIG9mIHRoZSBidWZmZXIgb3ZlcmZsb3csCnBsdXMg YWN0dWFsbHkgY2F0Y2ggdGhlIGJ1ZmZlciBvdmVyZmxvdy4KCkNjOiBKaWF4aW4gV3UgPGppYXhp bi53dUBpbnRlbC5jb20+CkNjOiBNYWNpZWogUmFiZWRhIDxtYWNpZWoucmFiZWRhQGxpbnV4Lmlu dGVsLmNvbT4KQ2M6IFBoaWxpcHBlIE1hdGhpZXUtRGF1ZMOpIDxwaGlsbWRAcmVkaGF0LmNvbT4K Q2M6IFNpeXVhbiBGdSA8c2l5dWFuLmZ1QGludGVsLmNvbT4KUmVmOiBodHRwczovL2J1Z3ppbGxh LnRpYW5vY29yZS5vcmcvc2hvd19idWcuY2dpP2lkPTMzNTYKU2lnbmVkLW9mZi1ieTogTGFzemxv IEVyc2VrIDxsZXJzZWtAcmVkaGF0LmNvbT4KUmV2aWV3ZWQtYnk6IE1hY2llaiBSYWJlZGEgPG1h Y2llai5yYWJlZGFAbGludXguaW50ZWwuY29tPgpSZXZpZXdlZC1ieTogUGhpbGlwcGUgTWF0aGll dS1EYXVkw6kgPHBoaWxtZEByZWRoYXQuY29tPgotLS0KIE5ldHdvcmtQa2cvSVNjc2lEeGUvSVNj c2lNaXNjLmggfCAgMyArKysKIE5ldHdvcmtQa2cvSVNjc2lEeGUvSVNjc2lNaXNjLmMgfCAyMCAr KysrKysrKysrKysrKysrKy0tLQogMiBmaWxlcyBjaGFuZ2VkLCAyMCBpbnNlcnRpb25zKCspLCAz IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL05ldHdvcmtQa2cvSVNjc2lEeGUvSVNjc2lNaXNj LmggYi9OZXR3b3JrUGtnL0lTY3NpRHhlL0lTY3NpTWlzYy5oCmluZGV4IDQwNGE0ODJlNTdmMy4u ZmRkZWY0ZjQ2NmRjIDEwMDY0NAotLS0gYS9OZXR3b3JrUGtnL0lTY3NpRHhlL0lTY3NpTWlzYy5o CisrKyBiL05ldHdvcmtQa2cvSVNjc2lEeGUvSVNjc2lNaXNjLmgKQEAgLTE1NiwzOCArMTU2LDQx IEBAIElTY3NpQXNjaWlTdHJUb0lwICgKICoqLw0KIEVGSV9TVEFUVVMNCiBJU2NzaUJpblRvSGV4 ICgNCiAgIElOICAgICBVSU5UOCAgKkJpbkJ1ZmZlciwNCiAgIElOICAgICBVSU5UMzIgQmluTGVu Z3RoLA0KICAgSU4gT1VUIENIQVI4ICAqSGV4U3RyLA0KICAgSU4gT1VUIFVJTlQzMiAqSGV4TGVu Z3RoDQogICApOw0KIA0KIC8qKg0KICAgQ29udmVydCB0aGUgaGV4YWRlY2ltYWwgc3RyaW5nIGlu dG8gYSBiaW5hcnkgZW5jb2RlZCBidWZmZXIuDQogDQogICBAcGFyYW1baW4sIG91dF0gIEJpbkJ1 ZmZlciAgICBUaGUgYmluYXJ5IGJ1ZmZlci4NCiAgIEBwYXJhbVtpbiwgb3V0XSAgQmluTGVuZ3Ro ICAgIExlbmd0aCBvZiB0aGUgYmluYXJ5IGJ1ZmZlci4NCiAgIEBwYXJhbVtpbl0gICAgICAgSGV4 U3RyICAgICAgIFRoZSBoZXhhZGVjaW1hbCBzdHJpbmcuDQogDQogICBAcmV0dmFsIEVGSV9TVUND RVNTICAgICAgICAgICBUaGUgaGV4YWRlY2ltYWwgc3RyaW5nIGlzIGNvbnZlcnRlZCBpbnRvIGEN CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGJpbmFyeSBlbmNvZGVkIGJ1ZmZlci4N CiAgIEByZXR2YWwgRUZJX0lOVkFMSURfUEFSQU1FVEVSIEludmFsaWQgaGV4IGVuY29kaW5nIGZv dW5kIGluIEhleFN0ci4NCisgIEByZXR2YWwgRUZJX0JBRF9CVUZGRVJfU0laRSAgIFRoZSBsZW5n dGggb2YgSGV4U3RyIGlzIHRvbyBsYXJnZSBmb3IgZGVjb2Rpbmc6DQorICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB0aGUgZGVjb2RlZCBzaXplIGNhbm5vdCBiZSBleHByZXNzZWQgaW4N CisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJpbkxlbmd0aCBvbiBvdXRwdXQuDQog ICBAcmV0dmFsIEVGSV9CVUZGRVJfVE9PX1NNQUxMICBUaGUgYmluYXJ5IGJ1ZmZlciBpcyB0b28g c21hbGwgdG8gaG9sZCB0aGUNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbnZl cnRlZCBkYXRhLg0KICoqLw0KIEVGSV9TVEFUVVMNCiBJU2NzaUhleFRvQmluICgNCiAgIElOIE9V VCBVSU5UOCAgKkJpbkJ1ZmZlciwNCiAgIElOIE9VVCBVSU5UMzIgKkJpbkxlbmd0aCwNCiAgIElO ICAgICBDSEFSOCAgKkhleFN0cg0KICAgKTsNCiANCiANCiAvKioNCiAgIENvbnZlcnQgdGhlIGRl Y2ltYWwtY29uc3RhbnQgc3RyaW5nIG9yIGhleC1jb25zdGFudCBzdHJpbmcgaW50byBhIG51bWVy aWNhbCB2YWx1ZS4NCiANCiAgIEBwYXJhbVtpbl0gU3RyICAgICAgICAgICAgICAgICAgICBTdHJp bmcgaW4gZGVjaW1hbCBvciBoZXguDQogDQogICBAcmV0dXJuIFRoZSBudW1lcmljYWwgdmFsdWUu DQogDQogKiovDQpkaWZmIC0tZ2l0IGEvTmV0d29ya1BrZy9JU2NzaUR4ZS9JU2NzaU1pc2MuYyBi L05ldHdvcmtQa2cvSVNjc2lEeGUvSVNjc2lNaXNjLmMKaW5kZXggZjBmNDk5MmIwN2M3Li40MDY5 NTQ3ODY3NTEgMTAwNjQ0Ci0tLSBhL05ldHdvcmtQa2cvSVNjc2lEeGUvSVNjc2lNaXNjLmMKKysr IGIvTmV0d29ya1BrZy9JU2NzaUR4ZS9JU2NzaU1pc2MuYwpAQCAtMzYxLDg5ICszNjEsMTAzIEBA IElTY3NpQmluVG9IZXggKAogICAgIEhleFN0cltJbmRleCAqIDIgKyAzXSA9IElTY3NpSGV4U3Ry aW5nW0JpbkJ1ZmZlcltJbmRleF0gJiAweGZdOw0KICAgfQ0KIA0KICAgSGV4U3RyW0luZGV4ICog MiArIDJdID0gJ1wwJzsNCiANCiAgIHJldHVybiBFRklfU1VDQ0VTUzsNCiB9DQogDQogDQogLyoq DQogICBDb252ZXJ0IHRoZSBoZXhhZGVjaW1hbCBzdHJpbmcgaW50byBhIGJpbmFyeSBlbmNvZGVk IGJ1ZmZlci4NCiANCiAgIEBwYXJhbVtpbiwgb3V0XSAgQmluQnVmZmVyICAgIFRoZSBiaW5hcnkg YnVmZmVyLg0KICAgQHBhcmFtW2luLCBvdXRdICBCaW5MZW5ndGggICAgTGVuZ3RoIG9mIHRoZSBi aW5hcnkgYnVmZmVyLg0KICAgQHBhcmFtW2luXSAgICAgICBIZXhTdHIgICAgICAgVGhlIGhleGFk ZWNpbWFsIHN0cmluZy4NCiANCiAgIEByZXR2YWwgRUZJX1NVQ0NFU1MgICAgICAgICAgIFRoZSBo ZXhhZGVjaW1hbCBzdHJpbmcgaXMgY29udmVydGVkIGludG8gYQ0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgYmluYXJ5IGVuY29kZWQgYnVmZmVyLg0KICAgQHJldHZhbCBFRklfSU5W QUxJRF9QQVJBTUVURVIgSW52YWxpZCBoZXggZW5jb2RpbmcgZm91bmQgaW4gSGV4U3RyLg0KKyAg QHJldHZhbCBFRklfQkFEX0JVRkZFUl9TSVpFICAgVGhlIGxlbmd0aCBvZiBIZXhTdHIgaXMgdG9v IGxhcmdlIGZvciBkZWNvZGluZzoNCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRo ZSBkZWNvZGVkIHNpemUgY2Fubm90IGJlIGV4cHJlc3NlZCBpbg0KKyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgQmluTGVuZ3RoIG9uIG91dHB1dC4NCiAgIEByZXR2YWwgRUZJX0JVRkZF Ul9UT09fU01BTEwgIFRoZSBiaW5hcnkgYnVmZmVyIGlzIHRvbyBzbWFsbCB0byBob2xkIHRoZQ0K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29udmVydGVkIGRhdGEuDQogKiovDQog RUZJX1NUQVRVUw0KIElTY3NpSGV4VG9CaW4gKA0KICAgSU4gT1VUIFVJTlQ4ICAqQmluQnVmZmVy LA0KICAgSU4gT1VUIFVJTlQzMiAqQmluTGVuZ3RoLA0KICAgSU4gICAgIENIQVI4ICAqSGV4U3Ry DQogICApDQogew0KKyAgVUlOVE4gICBCaW5MZW5ndGhNaW47DQorICBVSU5UMzIgIEJpbkxlbmd0 aFByb3ZpZGVkOw0KICAgVUlOVE4gICBJbmRleDsNCiAgIFVJTlROICAgTGVuZ3RoOw0KICAgVUlO VDggICBEaWdpdDsNCiAgIENIQVI4ICAgVGVtU3RyWzJdOw0KIA0KICAgWmVyb01lbSAoVGVtU3Ry LCBzaXplb2YgKFRlbVN0cikpOw0KIA0KICAgLy8NCiAgIC8vIEZpbmQgb3V0IGhvdyBtYW55IGhl eCBjaGFyYWN0ZXJzIHRoZSBzdHJpbmcgaGFzLg0KICAgLy8NCiAgIGlmICgoSGV4U3RyWzBdID09 ICcwJykgJiYgKChIZXhTdHJbMV0gPT0gJ3gnKSB8fCAoSGV4U3RyWzFdID09ICdYJykpKSB7DQog ICAgIEhleFN0ciArPSAyOw0KICAgfQ0KIA0KICAgTGVuZ3RoID0gQXNjaWlTdHJMZW4gKEhleFN0 cik7DQogDQogICAvLw0KICAgLy8gUmVqZWN0IGFuIGVtcHR5IGhleCBzdHJpbmc7IHJlamVjdCBh IHN0cmF5IG5pYmJsZS4NCiAgIC8vDQogICBpZiAoTGVuZ3RoID09IDAgfHwgTGVuZ3RoICUgMiAh PSAwKSB7DQogICAgIHJldHVybiBFRklfSU5WQUxJRF9QQVJBTUVURVI7DQogICB9DQorICAvLw0K KyAgLy8gQ2hlY2sgaWYgdGhlIGNhbGxlciBwcm92aWRlcyBlbm91Z2ggcm9vbSBmb3IgdGhlIGRl Y29kZWQgYmxvYi4NCisgIC8vDQorICBCaW5MZW5ndGhNaW4gPSBMZW5ndGggLyAyOw0KKyAgaWYg KEJpbkxlbmd0aE1pbiA+IE1BWF9VSU5UMzIpIHsNCisgICAgcmV0dXJuIEVGSV9CQURfQlVGRkVS X1NJWkU7DQorICB9DQorICBCaW5MZW5ndGhQcm92aWRlZCA9ICpCaW5MZW5ndGg7DQorICAqQmlu TGVuZ3RoID0gKFVJTlQzMilCaW5MZW5ndGhNaW47DQorICBpZiAoQmluTGVuZ3RoUHJvdmlkZWQg PCBCaW5MZW5ndGhNaW4pIHsNCisgICAgcmV0dXJuIEVGSV9CVUZGRVJfVE9PX1NNQUxMOw0KKyAg fQ0KIA0KICAgZm9yIChJbmRleCA9IDA7IEluZGV4IDwgTGVuZ3RoOyBJbmRleCArKykgew0KICAg ICBUZW1TdHJbMF0gPSBIZXhTdHJbSW5kZXhdOw0KICAgICBEaWdpdCA9IChVSU5UOCkgQXNjaWlT dHJIZXhUb1VpbnQ2NCAoVGVtU3RyKTsNCiAgICAgaWYgKERpZ2l0ID09IDAgJiYgVGVtU3RyWzBd ICE9ICcwJykgew0KICAgICAgIC8vDQogICAgICAgLy8gSW52YWxpZCBIZXggQ2hhci4NCiAgICAg ICAvLw0KICAgICAgIHJldHVybiBFRklfSU5WQUxJRF9QQVJBTUVURVI7DQogICAgIH0NCiAgICAg aWYgKChJbmRleCAmIDEpID09IDApIHsNCiAgICAgICBCaW5CdWZmZXIgW0luZGV4LzJdID0gRGln aXQ7DQogICAgIH0gZWxzZSB7DQogICAgICAgQmluQnVmZmVyIFtJbmRleC8yXSA9IChVSU5UOCkg KChCaW5CdWZmZXIgW0luZGV4LzJdIDw8IDQpICsgRGlnaXQpOw0KICAgICB9DQogICB9DQotDQot ICAqQmluTGVuZ3RoID0gKFVJTlQzMikgKChJbmRleCArIDEpLzIpOw0KLQ0KICAgcmV0dXJuIEVG SV9TVUNDRVNTOw0KIH0NCiANCiANCiAvKioNCiAgIENvbnZlcnQgdGhlIGRlY2ltYWwtY29uc3Rh bnQgc3RyaW5nIG9yIGhleC1jb25zdGFudCBzdHJpbmcgaW50byBhIG51bWVyaWNhbCB2YWx1ZS4N CiANCiAgIEBwYXJhbVtpbl0gU3RyICAgICAgICAgICAgICAgICAgICBTdHJpbmcgaW4gZGVjaW1h bCBvciBoZXguDQogDQogICBAcmV0dXJuIFRoZSBudW1lcmljYWwgdmFsdWUuDQogDQogKiovDQog VUlOVE4NCiBJU2NzaU5ldE50b2kgKA0KICAgSU4gICAgIENIQVI4ICAqU3RyDQogICApDQogew0K ICAgaWYgKChTdHJbMF0gPT0gJzAnKSAmJiAoKFN0clsxXSA9PSAneCcpIHx8IChTdHJbMV0gPT0g J1gnKSkpIHsNCiAgICAgU3RyICs9IDI7DQotLSAKMi4xOS4xLjMuZzMwMjQ3YWE1ZDIwMQoKCg==