From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lj1-f181.google.com (mail-lj1-f181.google.com [209.85.208.181]) by mx.groups.io with SMTP id smtpd.web11.7982.1593553120308623692 for ; Tue, 30 Jun 2020 14:38:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@broadcom.com header.s=google header.b=hvE706sf; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: broadcom.com, ip: 209.85.208.181, mailfrom: vladimir.olovyannikov@broadcom.com) Received: by mail-lj1-f181.google.com with SMTP id f5so8524550ljj.10 for ; Tue, 30 Jun 2020 14:38:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:references:in-reply-to:mime-version:thread-index:date :message-id:subject:to:cc; bh=Xe2S5sG0ERLD3QxgQtNvZnIjLCwcyGtrbLxl4xAxapQ=; b=hvE706sfZvAb18EkzlyE9M0VB1Gq5B4I+8n5MUkF6XXGhe89Are8yZ4C3H1f1AmPSE Eba89U3EWpqJKI0JpuMTkbbklB0xJOtNxVQA9Q9M0Vq9GCW7TWlMaUMtIsrxlYLVND9L AiL1kAbsdzXPBCq1t3MhICMDGuFpep8J6n1EQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:references:in-reply-to:mime-version :thread-index:date:message-id:subject:to:cc; bh=Xe2S5sG0ERLD3QxgQtNvZnIjLCwcyGtrbLxl4xAxapQ=; b=fw9hSo4Tjd2Xe+elMBLAF+ED5CRleeoIPHg3O+YzCuDGVinaZnnkZfglhMlJUiPpND YS7SGiDCiSTvZ9KMwxFFKWDhHWxc8eAWUPF9C4rj5YhTNw+gz/YKIll9/XAoQpwaaT5a 3BkntTXkjhulNUHdBbq1UDn1m7lAIsZKP5bgXBfXFB//FQeDXyuGYCFAL+QlxGJIg825 xyhnhKL3r1iy28f3O09bHxhrIdhrrgUx7i1NKN07vF6DFUvVU/AnjPYBZP8qiWpm/M72 ak5sqEqOvFn3W/yRH3YriKnZQzC3p8mp1+AZbWC6PVRm/uK3VwPUZJBKJ4H7C0krF2W2 2Z5A== X-Gm-Message-State: AOAM533WHxQreGSRKNc2drtJJHh616VelDanyZs6Xgj8/0RdQrhQf+Ek OE+xeJL7VRwihkqIoCYlYVlWMQx7gwyqHDnKvtcEHg== X-Google-Smtp-Source: ABdhPJwAIuTuQMuGOivrNRdsX5D4eb9U4ExOjopYwSAfJcEXfwB7ysW8BX8cJRXFQKvD6L7l/xo4v9gXDnOOUA6BCbM= X-Received: by 2002:a2e:b8ce:: with SMTP id s14mr10836612ljp.89.1593553118455; Tue, 30 Jun 2020 14:38:38 -0700 (PDT) From: "Vladimir Olovyannikov" References: <20200605001810.12822-1-vladimir.olovyannikov@broadcom.com> In-Reply-To: MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQL+YV3egfHAOVq48EtrCCS3gjoA1QJYEIqgpo7CxqA= Date: Tue, 30 Jun 2020 14:38:35 -0700 Message-ID: <61d94080f7f194baba6c4249b40fec6f@mail.gmail.com> Subject: Re: [edk2-devel] [PATCH v1 1/1] MdePkg : UefiFileHandleLib: fix buffer overrun in FileHandleReadLine() To: "Liu, Zhiguang" , devel@edk2.groups.io Cc: "Kinney, Michael D" , "Gao, Liming" Content-Type: text/plain; charset="UTF-8" Hi Zhiguang, Thank you for reviewing my commit. I thought, the variable was used only once in the if {} statement, so had it declared only there. I will declare it in the beginning of the function if it is a standard. Will submit patch v2. Thank you, Vladimir > -----Original Message----- > From: Liu, Zhiguang > Sent: Saturday, June 27, 2020 11:31 PM > To: devel@edk2.groups.io; vladimir.olovyannikov@broadcom.com > Cc: Kinney, Michael D ; Gao, Liming > > Subject: RE: [edk2-devel] [PATCH v1 1/1] MdePkg : UefiFileHandleLib: fix > buffer overrun in FileHandleReadLine() > > Hi Vladimir > Thanks for catching this bug. And I agree with you about your code change. > One little problem is that we always define the variable in the beginning of > the function. > Please fix the little issue and I will give my RB. > > Thanks > Zhiguang > > > -----Original Message----- > > From: devel@edk2.groups.io On Behalf Of > > Vladimir Olovyannikov via groups.io > > Sent: Friday, June 5, 2020 8:18 AM > > To: devel@edk2.groups.io > > Cc: Vladimir Olovyannikov ; > > Kinney, Michael D ; Gao, Liming > > > > Subject: [edk2-devel] [PATCH v1 1/1] MdePkg : UefiFileHandleLib: fix > > buffer overrun in FileHandleReadLine() > > > > If the size of the supplied buffer in FileHandleReadLine(), module > > UefiFileHandleLib.c, was not 0, but was not enough to fit in the line, > > the size is increased, and then the Buffer of the new size is zeroed. > > This size is always larger than the supplied buffer size, causing > > supplied buffer overrun. Fix the issue by using the supplied buffer > > size in ZeroMem(). > > > > Signed-off-by: Vladimir Olovyannikov > > > > Cc: Michael D Kinney > > Cc: Liming Gao > > --- > > MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c | 7 +++++-- > > 1 file changed, 5 insertions(+), 2 deletions(-) > > > > diff --git a/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c > > b/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c > > index 28e28e5f67d5..4bc9fabb6c74 100644 > > --- a/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c > > +++ b/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c > > @@ -1039,10 +1039,13 @@ FileHandleReadLine( > > // if we ran out of space tell when... > > > > // > > > > if ((CountSoFar+1-CrCount)*sizeof(CHAR16) > *Size){ > > > > + UINTN OldSize; > > > > + > > > > + OldSize = *Size; > > > > *Size = (CountSoFar+1-CrCount)*sizeof(CHAR16); > > > > if (!Truncate) { > > > > - if (Buffer != NULL && *Size != 0) { > > > > - ZeroMem(Buffer, *Size); > > > > + if (Buffer != NULL && OldSize != 0) { > > > > + ZeroMem(Buffer, OldSize); > > > > } > > > > FileHandleSetPosition(Handle, OriginalFilePosition); > > > > return (EFI_BUFFER_TOO_SMALL); > > > > -- > > 2.26.2.266.ge870325ee8 > > > > > > -=-=-=-=-=-= > > Groups.io Links: You receive all messages sent to this group. > > > > View/Reply Online (#60736): > > https://edk2.groups.io/g/devel/message/60736 > > Mute This Topic: https://groups.io/mt/74683735/1779286 > > Group Owner: devel+owner@edk2.groups.io > > Unsubscribe: https://edk2.groups.io/g/devel/unsub > > [zhiguang.liu@intel.com] > > -=-=-=-=-=-=