From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id CD80EAC089B for ; Fri, 8 Sep 2023 02:08:20 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=0quPgDdoN/ODz/8BoEsvEcFC4nwZ4gd/kffmvSqduuo=; c=relaxed/simple; d=groups.io; h=DKIM-Filter:From:To:Cc:Subject:Date:Message-ID:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1694138899; v=1; b=vwJECQEa2FAbhH7u0VFVhJyqwKMGzh4ddl32NDKAIOy4QWx8XXYNYaplETVFo7IFYxSC5aBY J/MAx3awWejKYfy1jCO4mL8UqNsV3sXyTEiE3Eqjc3mqVXJ0HZ73Ki2SBVE9vFbYgjRWK9XagfT FpJCrcyFMSJyAIpJMyIDxk24= X-Received: by 127.0.0.2 with SMTP id XRs1YY7687511xZjXV1SJzA4; Thu, 07 Sep 2023 19:08:19 -0700 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web10.30873.1694138898722838786 for ; Thu, 07 Sep 2023 19:08:18 -0700 X-Received: from gem-name-lb-02.localdomain (unknown [47.201.241.95]) by linux.microsoft.com (Postfix) with ESMTPSA id 01A25212B5C0; Thu, 7 Sep 2023 19:08:16 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 01A25212B5C0 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Jian J Wang , Liming Gao , Dandan Bi , Eric Dong Subject: [edk2-devel] [PATCH v1 1/1] MdeModulePkg/BootMaintenanceManagerUiLib: Check array index before access Date: Thu, 7 Sep 2023 22:08:01 -0400 Message-ID: <20230908020802.1059-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: q24ohUYZ4kwXrXiinVgeJxVTx7686176AA= Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=vwJECQEa; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=linux.microsoft.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io From: Michael Kubacki Many arrays are defined with a length of MAX_MENU_NUMBER in FormGuid.h. Two of those are BootOptionOrder and DriverOptionOrder. In UpdatePage.c, a pointer is set to either of those arrays. The array buffer is accessed using an index whose range is checked after the pointer to the array is dereferenced. This change moves the check before the dereference. In another place in the file, the ConsoleCheck pointer is also set to an array buffer with MAX_MENU_NUMBER elements. Only an ASSERT() currently checks the range of the array index. This change conditionalizes the pointer dereference itself on the range of Index. Cc: Jian J Wang Cc: Liming Gao Cc: Dandan Bi Cc: Eric Dong Signed-off-by: Michael Kubacki --- MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.c | 11 +++++= ++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.= c b/MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.c index ca81b7f35264..b1d1e2ee44f4 100644 --- a/MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.c +++ b/MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.c @@ -527,9 +527,12 @@ UpdateConsolePage ( ((NewTerminalContext->IsStdErr !=3D 0) && (UpdatePageId =3D=3D F= ORM_CON_ERR_ID)) ) { - CheckFlags |=3D EFI_IFR_CHECKBOX_DEFAULT; - ConsoleCheck[Index] =3D TRUE; - } else { + CheckFlags |=3D EFI_IFR_CHECKBOX_DEFAULT; + + if (Index < MAX_MENU_NUMBER) { + ConsoleCheck[Index] =3D TRUE; + } + } else if (Index < MAX_MENU_NUMBER) { ConsoleCheck[Index] =3D FALSE; } =20 @@ -622,7 +625,7 @@ UpdateOrderPage ( ASSERT (OptionsOpCodeHandle !=3D NULL); =20 NewMenuEntry =3D NULL; - for (OptionIndex =3D 0; (OptionOrder[OptionIndex] !=3D 0 && OptionInde= x < MAX_MENU_NUMBER); OptionIndex++) { + for (OptionIndex =3D 0; (OptionIndex < MAX_MENU_NUMBER && OptionOrder[= OptionIndex] !=3D 0); OptionIndex++) { BootOptionFound =3D FALSE; for (Index =3D 0; Index < OptionMenu->MenuNumber; Index++) { NewMenuEntry =3D BOpt_GetMenuEntry (OptionMenu, Index); --=20 2.42.0.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#108436): https://edk2.groups.io/g/devel/message/108436 Mute This Topic: https://groups.io/mt/101229613/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-