From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web12.3885.1576482953249776862 for ; Sun, 15 Dec 2019 23:55:53 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.31, mailfrom: jiewen.yao@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Dec 2019 23:55:52 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.69,320,1571727600"; d="scan'208";a="297612761" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by orsmga001.jf.intel.com with ESMTP; 15 Dec 2019 23:55:52 -0800 Received: from fmsmsx161.amr.corp.intel.com (10.18.125.9) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 15 Dec 2019 23:55:52 -0800 Received: from shsmsx108.ccr.corp.intel.com (10.239.4.97) by FMSMSX161.amr.corp.intel.com (10.18.125.9) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 15 Dec 2019 23:55:52 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.109]) by SHSMSX108.ccr.corp.intel.com ([169.254.8.46]) with mapi id 14.03.0439.000; Mon, 16 Dec 2019 15:55:50 +0800 From: "Yao, Jiewen" To: "Zhang, Shenglei" , "devel@edk2.groups.io" CC: "Wang, Jian J" , "Zhang, Chao B" Subject: Re: [PATCH v2] SecurityPkg/Tpm2Help.c: Add boundary check for array Thread-Topic: [PATCH v2] SecurityPkg/Tpm2Help.c: Add boundary check for array Thread-Index: AQHVs+XUpv5eCfOOeUulK+eSsxlUV6e8ZF3w Date: Mon, 16 Dec 2019 07:55:49 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F8A27E0@shsmsx102.ccr.corp.intel.com> References: <20191216075241.13060-1-shenglei.zhang@intel.com> In-Reply-To: <20191216075241.13060-1-shenglei.zhang@intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNjlkNzc5N2EtNDk0OS00NjVjLWFmZDUtOGQwNzM5MTg5Y2M1IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoibGxcLzgwSGdlRTlnVUw1cFhqd0RVR05lM1NSeXZpWHFGUFo4QnVuVHdHb202bEJMUTNcLzM1QThUTE1oRWxyTHR1In0= x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I don't think it is good idea to *ignore* the error. If you don't assert, please stop processor and return error. > -----Original Message----- > From: Zhang, Shenglei > Sent: Monday, December 16, 2019 3:53 PM > To: devel@edk2.groups.io > Cc: Yao, Jiewen ; Wang, Jian J ; > Zhang, Chao B > Subject: [PATCH v2] SecurityPkg/Tpm2Help.c: Add boundary check for array >=20 > Add 'Index < HASH_COUNT' to ensure things out of digests[] > can not be visited. >=20 > Cc: Jiewen Yao > Cc: Jian J Wang > Cc: Chao Zhang > Signed-off-by: Shenglei Zhang > --- > v2: Remove the comma operator and use &&. >=20 > SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) >=20 > diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c > b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c > index 36c240d1221c..d7bc94006003 100644 > --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c > +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c > @@ -299,7 +299,7 @@ GetDigestListSize ( > UINT32 TotalSize; >=20 > TotalSize =3D sizeof(DigestList->count); > - for (Index =3D 0; Index < DigestList->count; Index++) { > + for (Index =3D 0; Index < DigestList->count && Index < HASH_COUNT; Ind= ex++) { > DigestSize =3D GetHashSizeFromAlgo (DigestList->digests[Index].hashA= lg); > TotalSize +=3D sizeof(DigestList->digests[Index].hashAlg) + DigestSi= ze; > } > -- > 2.18.0.windows.1