From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.24; helo=mga09.intel.com; envelope-from=siyuan.fu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id CD68821159CA3 for ; Thu, 27 Sep 2018 19:32:41 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Sep 2018 19:32:41 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,313,1534834800"; d="scan'208";a="90251530" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by fmsmga002.fm.intel.com with ESMTP; 27 Sep 2018 19:32:41 -0700 Received: from FMSMSX109.amr.corp.intel.com (10.18.116.9) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 27 Sep 2018 19:32:40 -0700 Received: from shsmsx104.ccr.corp.intel.com (10.239.4.70) by fmsmsx109.amr.corp.intel.com (10.18.116.9) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 27 Sep 2018 19:32:40 -0700 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.245]) by SHSMSX104.ccr.corp.intel.com ([169.254.5.183]) with mapi id 14.03.0319.002; Fri, 28 Sep 2018 10:32:38 +0800 From: "Fu, Siyuan" To: "Li, Songpeng" , "edk2-devel@lists.01.org" CC: "Wu, Jiaxin" Thread-Topic: [edk2] [PATCH 1/2] NetworkPkg/HttpDxe: fix read memory access overflow in HTTPBoot. Thread-Index: AQHUVs6/URXaHFm7U0W0yeBu5bRYmKUE+Vzg Date: Fri, 28 Sep 2018 02:32:37 +0000 Message-ID: References: <20180928015706.32068-1-songpeng.li@intel.com> <20180928015706.32068-2-songpeng.li@intel.com> In-Reply-To: <20180928015706.32068-2-songpeng.li@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ctpclassification: CTP_NT x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZGM5MWUwYzAtMmY2Ni00M2YwLWE5MmItZDAwMDZiY2FhNmQ4IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiSDErUDFNQjdYa2FVQmsyYjNmSDZiUzlvek9TUlwvdUJwbTNwXC9uT0M0QmtUZG1pZklKNm9rTis2NFZQWkpiSVwvYiJ9 dlp-product: dlpe-windows dlp-version: 11.0.400.15 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH 1/2] NetworkPkg/HttpDxe: fix read memory access overflow in HTTPBoot. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Sep 2018 02:32:42 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Fu Siyuan > -----Original Message----- > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of > Songpeng Li > Sent: Friday, September 28, 2018 9:57 AM > To: edk2-devel@lists.01.org > Cc: Fu, Siyuan ; Wu, Jiaxin > Subject: [edk2] [PATCH 1/2] NetworkPkg/HttpDxe: fix read memory access > overflow in HTTPBoot. >=20 > The input param String of AsciiStrStr() requires a pointer to > Null-terminated string, however in HttpTcpReceiveHeader(), > the Buffersize before AllocateZeroPool() is equal to the size > of TCP header, after the CopyMem(), it might not end with > Null-terminator. It might cause memory access overflow. >=20 > Cc: Fu Siyuan > Cc: Wu Jiaxin > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1204 > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Songpeng Li > --- > NetworkPkg/HttpDxe/HttpProto.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) >=20 > diff --git a/NetworkPkg/HttpDxe/HttpProto.c > b/NetworkPkg/HttpDxe/HttpProto.c > index 94f89f5665..7d69429be7 100644 > --- a/NetworkPkg/HttpDxe/HttpProto.c > +++ b/NetworkPkg/HttpDxe/HttpProto.c > @@ -1914,10 +1914,10 @@ HttpTcpReceiveHeader ( > } >=20 > // > - // Append the response string. > + // Append the response string along with a Null-terminator. > // > *BufferSize =3D *SizeofHeaders + Fragment.Len; > - Buffer =3D AllocateZeroPool (*BufferSize); > + Buffer =3D AllocatePool (*BufferSize + 1); > if (Buffer =3D=3D NULL) { > Status =3D EFI_OUT_OF_RESOURCES; > return Status; > @@ -1933,6 +1933,7 @@ HttpTcpReceiveHeader ( > Fragment.Bulk, > Fragment.Len > ); > + *(Buffer + *BufferSize) =3D '\0'; > *HttpHeaders =3D Buffer; > *SizeofHeaders =3D *BufferSize; >=20 > @@ -2013,10 +2014,10 @@ HttpTcpReceiveHeader ( > } >=20 > // > - // Append the response string. > + // Append the response string along with a Null-terminator. > // > *BufferSize =3D *SizeofHeaders + Fragment.Len; > - Buffer =3D AllocateZeroPool (*BufferSize); > + Buffer =3D AllocatePool (*BufferSize + 1); > if (Buffer =3D=3D NULL) { > Status =3D EFI_OUT_OF_RESOURCES; > return Status; > @@ -2032,6 +2033,7 @@ HttpTcpReceiveHeader ( > Fragment.Bulk, > Fragment.Len > ); > + *(Buffer + *BufferSize) =3D '\0'; > *HttpHeaders =3D Buffer; > *SizeofHeaders =3D *BufferSize; >=20 > -- > 2.18.0.windows.1 >=20 > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel