From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=18.228.144.36; helo=mail.paulo.ac; envelope-from=paulo@paulo.ac; receiver=edk2-devel@lists.01.org Received: from mail.paulo.ac (mail.paulo.ac [18.228.144.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 1604021167446 for ; Fri, 26 Oct 2018 06:26:46 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.paulo.ac (Postfix) with ESMTP id F2B6848188B5; Fri, 26 Oct 2018 13:26:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=paulo.ac; s=default; t=1540560403; bh=xeUKAUuKm3UgL5R0N1QIQUbdoqDdh+QKzO1bZyUHVP0=; h=From:To:Cc:Subject:In-Reply-To:References:Date; b=rdajRe1/iKWaTM/aIA3RrLzfvJgajAPH3v+xuGk0NwSmYP7CItNuw3qsdSRuyg59n tQEgoHu4Sl/d33OsWdPyORm2Ja7X/RD7gop/lVn+gp/Spqfo6tzv6IjVtj2CDk3yfG X1Bi69G+FuHrqRN3Oyg+Q4xxo1vNsyvF3gioMSB8= Received: from mail.paulo.ac ([127.0.0.1]) by localhost (ip-172-31-5-70.sa-east-1.compute.internal [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1WF8nRBdlZsR; Fri, 26 Oct 2018 13:26:43 +0000 (UTC) Received: from localhost (unknown [187.112.54.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.paulo.ac (Postfix) with ESMTPSA id C7DF648188B3; Fri, 26 Oct 2018 13:26:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=paulo.ac; s=default; t=1540560403; bh=xeUKAUuKm3UgL5R0N1QIQUbdoqDdh+QKzO1bZyUHVP0=; h=From:To:Cc:Subject:In-Reply-To:References:Date; b=rdajRe1/iKWaTM/aIA3RrLzfvJgajAPH3v+xuGk0NwSmYP7CItNuw3qsdSRuyg59n tQEgoHu4Sl/d33OsWdPyORm2Ja7X/RD7gop/lVn+gp/Spqfo6tzv6IjVtj2CDk3yfG X1Bi69G+FuHrqRN3Oyg+Q4xxo1vNsyvF3gioMSB8= From: Paulo Alcantara To: Hao Wu , edk2-devel@lists.01.org Cc: Hao Wu , Ruiyu Ni , Star Zeng In-Reply-To: <20181026075457.6280-1-hao.a.wu@intel.com> References: <20181026075457.6280-1-hao.a.wu@intel.com> Date: Fri, 26 Oct 2018 10:26:00 -0300 Message-ID: <87tvl8hmaf.fsf@paulo.ac> MIME-Version: 1.0 Subject: Re: [PATCH] MdeModulePkg/UdfDxe: Additional checks for ResolveSymlink() X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Oct 2018 13:26:47 -0000 Content-Type: text/plain Hao Wu writes: > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1279 > > The commit will add 3 types of checks for function ResolveSymlink(): > > A. Check for the value of 'Component Type' field within a Path Component > > According to the ECMA-167 standard (3rd Edition - June 1997), Section > 14.16.1.1, valid values are 1 to 5. All other values will be treated as a > corrupted volume. > > B. Check for the content pointed by 'File' > > Since content within 'File' is the output data for ResolveSymlink(). > Checks is added to ensure the content in 'File' is valid. Otherwise, > possible null pointer dereference issue will occur during the subsequent > usage of the data returned by ResolveSymlink(). > > C. Check for possible memory double free/use after free case > > For codes: > > if (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent, > sizeof (UDF_FILE_INFO)) != 0) { > CleanupFileInformation (&PreviousFile); > } > > CopyMem ((VOID *)&PreviousFile, (VOID *)File, sizeof (UDF_FILE_INFO)); > > If the contents in 'PreviousFile' and 'File' are the same, call to > "CleanupFileInformation (&PreviousFile);" will free the buffers in 'File' > as well. This will lead to potential memory double free/use after free > issues. > > Cc: Paulo Alcantara > Cc: Paulo Alcantara > Cc: Ruiyu Ni > Cc: Star Zeng > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Hao Wu > --- > .../Universal/Disk/UdfDxe/FileSystemOperations.c | 30 ++++++++++++++++++++-- > 1 file changed, 28 insertions(+), 2 deletions(-) > > diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c > index b9ebddfe62..a89e5ba9ff 100644 > --- a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c > +++ b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c > @@ -2145,6 +2145,8 @@ ResolveSymlink ( > UINT8 CompressionId; > UDF_FILE_INFO PreviousFile; > > + ZeroMem ((VOID *)File, sizeof (UDF_FILE_INFO)); > + > // > // Symlink files on UDF volumes do not contain so much data other than > // Path Components which resolves to real filenames, so it's OK to read in > @@ -2257,6 +2259,13 @@ ResolveSymlink ( > } > FileName[Index] = L'\0'; > break; > + default: > + // > + // Accoring to the ECMA-167 standard (3rd Edition - June 1997), Section > + // 14.16.1.1, all other values are reserved. > + // > + Status = EFI_VOLUME_CORRUPTED; > + goto Error_Find_File; > } > > // > @@ -2281,8 +2290,18 @@ ResolveSymlink ( > break; > } > > - if (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent, > - sizeof (UDF_FILE_INFO)) != 0) { > + // > + // Check the content in the file info pointed by File. > + // > + if ((File->FileEntry == NULL) || (File->FileIdentifierDesc == NULL)) { > + Status = EFI_VOLUME_CORRUPTED; > + goto Error_Find_File; > + } > + > + if ((CompareMem ((VOID *)&PreviousFile, (VOID *)Parent, > + sizeof (UDF_FILE_INFO)) != 0) && > + (CompareMem ((VOID *)&PreviousFile, (VOID *)File, > + sizeof (UDF_FILE_INFO)) != 0)) { > CleanupFileInformation (&PreviousFile); > } > > @@ -2294,6 +2313,13 @@ ResolveSymlink ( > // > FreePool (ReadFileInfo.FileData); > > + // > + // Check the content in the resolved file info. > + // > + if ((File->FileEntry == NULL) || (File->FileIdentifierDesc == NULL)) { > + return EFI_VOLUME_CORRUPTED; > + } > + > return EFI_SUCCESS; > > Error_Find_File: Reviewed-by: Paulo Alcantara Thanks! Paulo