[edk2-devel] [PATCH V1 1/1] SecurityPkg/DxeTpm2MeasureBootLib: Check the Integer overflow

[edk2-devel] [PATCH V1 1/1] SecurityPkg/DxeTpm2MeasureBootLib: Check the Integer overflow

[sunceping]

From: Ceping Sun <cepingx.sun@intel.com>

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4604

Fields of NumberOfPartitionEntries and SizeOfPartitionEntry in
PrimaryHeader are both UINT32. UINT32 * UINT32 produce UINT32
but it may overflow. So The result should be checked if it is
overflow.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Signed-off-by: Ceping Sun <cepingx.sun@intel.com>
---
 .../Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c    | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
index 36a256a7af50..1f891ae7f216 100644
--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
@@ -210,6 +210,11 @@ Tcg2MeasureGptTable (
     return EFI_BAD_BUFFER_SIZE;
   }
 
+  if (PrimaryHeader->NumberOfPartitionEntries > MAX_UINT32 / PrimaryHeader->SizeOfPartitionEntry) {
+    DEBUG ((DEBUG_ERROR, "Overflow of PrimaryHeader->NumberOfPartitionEntries(%d) * PrimaryHeader->SizeOfPartitionEntry(%d)\n", PrimaryHeader->NumberOfPartitionEntries, PrimaryHeader->SizeOfPartitionEntry));
+    return EFI_INVALID_PARAMETER;
+  }
+
   //
   // Read the partition entry.
   //
-- 
2.34.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#111710): https://edk2.groups.io/g/devel/message/111710
Mute This Topic: https://groups.io/mt/102820849/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [edk2-devel] [PATCH V1 1/1] SecurityPkg/DxeTpm2MeasureBootLib: Check the Integer overflow

[Min Xu]

Reviewed-by: Min Xu <min.m.xu@intel.com>

> -----Original Message-----
> From: Sun, CepingX <cepingx.sun@intel.com>
> Sent: Monday, November 27, 2023 8:41 AM
> To: devel@edk2.groups.io
> Cc: Sun, CepingX <cepingx.sun@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>; Xu, Min M <min.m.xu@intel.com>
> Subject: [PATCH V1 1/1] SecurityPkg/DxeTpm2MeasureBootLib: Check the
> Integer overflow
> 
> From: Ceping Sun <cepingx.sun@intel.com>
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4604
> 
> Fields of NumberOfPartitionEntries and SizeOfPartitionEntry in PrimaryHeader
> are both UINT32. UINT32 * UINT32 produce UINT32 but it may overflow. So
> The result should be checked if it is overflow.
> 
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Signed-off-by: Min Xu <min.m.xu@intel.com>
> Signed-off-by: Ceping Sun <cepingx.sun@intel.com>
> ---
>  .../Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c    | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git
> a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
> b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
> index 36a256a7af50..1f891ae7f216 100644
> ---
> a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
> +++
> b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
> @@ -210,6 +210,11 @@ Tcg2MeasureGptTable (
>      return EFI_BAD_BUFFER_SIZE;
>    }
> 
> +  if (PrimaryHeader->NumberOfPartitionEntries > MAX_UINT32 /
> PrimaryHeader->SizeOfPartitionEntry) {
> +    DEBUG ((DEBUG_ERROR, "Overflow of PrimaryHeader-
> >NumberOfPartitionEntries(%d) * PrimaryHeader-
> >SizeOfPartitionEntry(%d)\n", PrimaryHeader->NumberOfPartitionEntries,
> PrimaryHeader->SizeOfPartitionEntry));
> +    return EFI_INVALID_PARAMETER;
> +  }
> +
>    //
>    // Read the partition entry.
>    //
> --
> 2.34.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#111831): https://edk2.groups.io/g/devel/message/111831
Mute This Topic: https://groups.io/mt/102820849/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-