public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Gao, Zhichao" <zhichao.gao@intel.com>
To: Krzysztof Koch <krzysztof.koch@arm.com>,
	"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: "Carsey, Jaben" <jaben.carsey@intel.com>,
	"Ni, Ray" <ray.ni@intel.com>,
	"Sami.Mujawar@arm.com" <Sami.Mujawar@arm.com>,
	"Matteo.Carlini@arm.com" <Matteo.Carlini@arm.com>,
	"nd@arm.com" <nd@arm.com>
Subject: Re: [PATCH v1 1/6] ShellPkg: acpiview: Allow passing buffer length to DumpGasStruct()
Date: Fri, 19 Jul 2019 01:14:39 +0000	[thread overview]
Message-ID: <3CE959C139B4C44DBEA1810E3AA6F9000B808DB0@SHSMSX101.ccr.corp.intel.com> (raw)
In-Reply-To: <20190718123142.5696-2-krzysztof.koch@arm.com>



> -----Original Message-----
> From: Krzysztof Koch [mailto:krzysztof.koch@arm.com]
> Sent: Thursday, July 18, 2019 8:32 PM
> To: devel@edk2.groups.io
> Cc: Carsey, Jaben <jaben.carsey@intel.com>; Ni, Ray <ray.ni@intel.com>;
> Gao, Zhichao <zhichao.gao@intel.com>; Sami.Mujawar@arm.com;
> Matteo.Carlini@arm.com; nd@arm.com
> Subject: [PATCH v1 1/6] ShellPkg: acpiview: Allow passing buffer length to
> DumpGasStruct()
> 
> Modify the signature of the DumpGasStruct() function to include the buffer
> length parameter and to return the number of bytes parsed by the function.
> 
> This way it becomes possible to prevent buffer overruns when dumping
> Generic Address Structure's (GAS) fields in the acpiview table parsers.
> 
> Update all existing DumpGasStruct() calls in acpiview to add the length
> argument.
> 
> Signed-off-by: Krzysztof Koch <krzysztof.koch@arm.com>
> ---
> 
> Notes:
>     v1:
>     - Modify DumpGasStruct() signature [Krzysztof]
> 
>  ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.c              | 26
> +++++++++++---------
>  ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.h              |  8
> ++++--
> 
> ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Dbg2/Dbg2Parser.c
> |  2 +-
>  3 files changed, 22 insertions(+), 14 deletions(-)
> 
> diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.c
> b/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.c
> index
> 8b3153516d2b7d9b920ab2de0344c17798ac572c..2d6ff80e299eebe7853061d3
> db89332197c0dc0e 100644
> --- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.c
> +++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.c
> @@ -589,23 +589,27 @@ STATIC CONST ACPI_PARSER GasParser[] = {
> 
>    @param [in] Ptr     Pointer to the start of the buffer.
>    @param [in] Indent  Number of spaces to indent the output.
> +  @param [in] Length  Length of the GAS structure buffer.
> +
> +  @retval Number of bytes parsed.
>  **/
> -VOID
> +UINT32
>  EFIAPI
>  DumpGasStruct (
>    IN UINT8*        Ptr,
> -  IN UINT32        Indent
> +  IN UINT32        Indent,
> +  IN UINT32        Length
>    )
>  {
>    Print (L"\n");
> -  ParseAcpi (
> -    TRUE,
> -    Indent,
> -    NULL,
> -    Ptr,
> -    GAS_LENGTH,
> -    PARSER_PARAMS (GasParser)
> -    );
> +  return ParseAcpi (
> +           TRUE,
> +           Indent,
> +           NULL,
> +           Ptr,
> +           Length,
> +           PARSER_PARAMS (GasParser)
> +           );
>  }
> 
>  /**
> @@ -621,7 +625,7 @@ DumpGas (
>    IN UINT8*        Ptr
>    )
>  {
> -  DumpGasStruct (Ptr, 2);
> +  DumpGasStruct (Ptr, 2, GAS_LENGTH);
>  }
> 
>  /**
> diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.h
> b/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.h
> index
> 7657892d9fd2e2e14c6578611ff0cf1b6f6cd750..20ca358bddfa5953bfb1d1beba
> ebbf3079eaba01 100644
> --- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.h
> +++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiParser.h
> @@ -405,12 +405,16 @@ ParseAcpi (
> 
>    @param [in] Ptr     Pointer to the start of the buffer.
>    @param [in] Indent  Number of spaces to indent the output.
> +  @param [in] Length  Length of the GAS structure buffer.
> +
> +  @retval Number of bytes parsed.
>  **/
> -VOID
> +UINT32
>  EFIAPI
>  DumpGasStruct (
>    IN UINT8*        Ptr,
> -  IN UINT32        Indent
> +  IN UINT32        Indent,
> +  IN UINT32        Length
>    );
> 
>  /**
> diff --git
> a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Dbg2/Dbg2Parse
> r.c
> b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Dbg2/Dbg2Parse
> r.c
> index
> 8de5ebf74775bab8e765849cba6ef4eb6f659a5a..2c47a3f848aa2dd512c53343e
> cf1c3c285173dd6 100644
> ---
> a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Dbg2/Dbg2Parse
> r.c
> +++
> b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Dbg2/Dbg2Pars
> +++ er.c
> @@ -164,7 +164,7 @@ DumpDbgDeviceInfo (
>    AddrSize = (UINT32*)(Ptr + (*AddrSizeOffset));
>    while (Index < (*GasCount)) {
>      PrintFieldName (4, L"BaseAddressRegister");
> -    DumpGasStruct (DataPtr, 4);
> +    DumpGasStruct (DataPtr, 4, *DbgDevInfoLen);

This input length should be GAS_LENGTH. *DbgDevInfoLen is the length of the whole structure and the DataPtr is increased during the loop. Inputing such a length would give the ParseAcpi function a chance to overrun the DataPtr.

Thanks,
Zhichao

>      PrintFieldName (4, L"Address Size");
>      Print (L"0x%x\n", AddrSize[Index]);
>      DataPtr += GAS_LENGTH;
> --
> 'Guid(CE165669-3EF3-493F-B85D-6190EE5B9759)'
> 


  parent reply	other threads:[~2019-07-19  1:14 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-18 12:31 [PATCH v1 0/6] Acpiview table parsers code style enhancements and refactoring Krzysztof Koch
2019-07-18 12:31 ` [PATCH v1 1/6] ShellPkg: acpiview: Allow passing buffer length to DumpGasStruct() Krzysztof Koch
2019-07-18 15:32   ` [edk2-devel] " Alexei Fedorov
2019-07-19  1:14   ` Gao, Zhichao [this message]
     [not found]     ` <VE1PR08MB47831B4BE6619A6C85953A6E84CB0@VE1PR08MB4783.eurprd08.prod.outlook.com>
     [not found]       ` <3CE959C139B4C44DBEA1810E3AA6F9000B808FFA@SHSMSX101.ccr.corp.intel.com>
2019-07-19 10:40         ` Krzysztof Koch
2019-07-22  0:38           ` Gao, Zhichao
2019-07-18 12:31 ` [PATCH v1 2/6] ShellPkg: acpiview: XSDT: Remove redundant ParseAcpi() call Krzysztof Koch
2019-07-18 15:31   ` [edk2-devel] " Alexei Fedorov
2019-07-18 12:31 ` [PATCH v1 3/6] ShellPkg: acpiview: RSDP: Make code consistent with other parsers Krzysztof Koch
2019-07-18 15:31   ` [edk2-devel] " Alexei Fedorov
2019-07-18 12:31 ` [PATCH v1 4/6] ShellPkg: acpiview: SRAT: Minor code style enhancements Krzysztof Koch
2019-07-18 15:31   ` [edk2-devel] " Alexei Fedorov
2019-07-18 12:31 ` [PATCH v1 5/6] ShellPkg: acpiview: MADT: Split structure length validation Krzysztof Koch
2019-07-18 15:31   ` [edk2-devel] " Alexei Fedorov
2019-07-18 12:31 ` [PATCH v1 6/6] ShellPkg: acpiview: IORT: Refactor PMCG node mapping count validation Krzysztof Koch
2019-07-18 15:30   ` [edk2-devel] " Alexei Fedorov
2019-07-18 12:58 ` [PATCH v1 0/6] Acpiview table parsers code style enhancements and refactoring Sami Mujawar
2019-07-18 14:48 ` [edk2-devel] " Carsey, Jaben
2019-07-19  1:09 ` Gao, Zhichao

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3CE959C139B4C44DBEA1810E3AA6F9000B808DB0@SHSMSX101.ccr.corp.intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox