From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web10.1502.1662731941239464984 for ; Fri, 09 Sep 2022 06:59:01 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@linux.microsoft.com header.s=default header.b=lFXZcEna; spf=pass (domain: linux.microsoft.com, ip: 13.77.154.182, mailfrom: mikuback@linux.microsoft.com) Received: from localhost.localdomain (unknown [47.195.228.134]) by linux.microsoft.com (Postfix) with ESMTPSA id E39BC20B929C; Fri, 9 Sep 2022 06:58:59 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com E39BC20B929C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1662731940; bh=MRlJ871ciOU/lUY2Cd/h7lRvONU8sPhDDm4pf4YmboY=; h=From:To:Cc:Subject:Date:From; b=lFXZcEnaS7iooy2kF7WgCZHJwZXYrrM/3qEeLMdKpHSXzBa75sqVkdSpCknbLUofo 8d3BCxmmU0RsEikL5AL2arbkmimFnUIjhHENaTBkUkjw5VwDK/5YxjH6qzywHT7HmT ZMTPl5tZ5Bud21WHlduFJLhvjB6LLKvFRY9AYY9k= From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Chasel Chiu , Nate DeSimone , Isaac Oram , Liming Gao , Eric Dong Subject: [edk2-platforms][PATCH v1 1/1] MinPlatformPkg/TestPointCheckLib: Fix out of bounds array index access Date: Fri, 9 Sep 2022 09:58:43 -0400 Message-Id: <20220909135843.659-1-mikuback@linux.microsoft.com> X-Mailer: git-send-email 2.28.0.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Michael Kubacki The following code accesses array index "6" which is invalid as the array is of length 6. DEBUG ((DEBUG_INFO, " %08x %08x %08x %08x %08x %08x", PciData->Device.Bar[0], PciData->Device.Bar[1], PciData->Device.Bar[2], PciData->Device.Bar[3], PciData->Device.Bar[4], PciData->Device.Bar[6] <-- BAD ARRAY INDEX )); PciData is of type "PCI_TYPE00": typedef struct { PCI_DEVICE_INDEPENDENT_REGION Hdr; PCI_DEVICE_HEADER_TYPE_REGION Device; } PCI_TYPE00; "PCI_DEVICE_HEADER_TYPE_REGION": typedef struct { UINT32 Bar[6]; <- NOTE: ARRAY LENGTH IS 6 UINT32 CISPtr; UINT16 SubsystemVendorID; UINT16 SubsystemID; UINT32 ExpansionRomBar; UINT8 CapabilityPtr; UINT8 Reserved1[3]; UINT32 Reserved2; UINT8 InterruptLine; UINT8 InterruptPin; UINT8 MinGnt; UINT8 MaxLat; } PCI_DEVICE_HEADER_TYPE_REGION; This change fixes the array index value. Cc: Chasel Chiu Cc: Nate DeSimone Cc: Isaac Oram Cc: Liming Gao Cc: Eric Dong Signed-off-by: Michael Kubacki --- Platform/Intel/MinPlatformPkg/Test/Library/TestPointCheckLib/DxeCheckPci= .c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Platform/Intel/MinPlatformPkg/Test/Library/TestPointCheckLib= /DxeCheckPci.c b/Platform/Intel/MinPlatformPkg/Test/Library/TestPointChec= kLib/DxeCheckPci.c index 514003944758..575284ccc727 100644 --- a/Platform/Intel/MinPlatformPkg/Test/Library/TestPointCheckLib/DxeChe= ckPci.c +++ b/Platform/Intel/MinPlatformPkg/Test/Library/TestPointCheckLib/DxeChe= ckPci.c @@ -75,7 +75,7 @@ DumpPciDevice ( PciData->Device.Bar[2], PciData->Device.Bar[3], PciData->Device.Bar[4], - PciData->Device.Bar[6] + PciData->Device.Bar[5] )); DEBUG ((DEBUG_INFO, " %04x\n", PciData->Hdr.Command @@ -256,7 +256,7 @@ TestPointCheckPciResource ( UINT16 MinBus; UINT16 MaxBus; BOOLEAN IsEnd; - =20 + DEBUG ((DEBUG_INFO, "=3D=3D=3D=3D TestPointCheckPciResource - Enter\n"= )); HandleBuf =3D NULL; Status =3D gBS->LocateHandleBuffer ( @@ -338,7 +338,7 @@ TestPointCheckPciResource ( // Device DumpPciDevice ((UINT8)Bus, (UINT8)Device, (UINT8)Func, &= PciData); } - =20 + // // If this is not a multi-function device, we can leave th= e loop // to deal with the next device. @@ -360,7 +360,7 @@ TestPointCheckPciResource ( } } } - =20 + Done: if (HandleBuf !=3D NULL) { FreePool (HandleBuf); --=20 2.28.0.windows.1