* [PATCH] MdeModulePkg/Core: Fix potential array overflow
@ 2017-11-23 1:06 Jian J Wang
2017-11-23 1:38 ` Wu, Hao A
0 siblings, 1 reply; 2+ messages in thread
From: Jian J Wang @ 2017-11-23 1:06 UTC (permalink / raw)
To: edk2-devel; +Cc: Wu Hao, Star Zeng, Eric Dong
In the method DumpGuardedMemoryBitmap() and SetAllGuardPages(), the code
didn't check if the global mMapLevel is legal value or not, which leaves
a logic hole causing potential array overflow in code followed.
This patch adds sanity check before any array reference in those methods.
Cc: Wu Hao <hao.a.wu@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
---
MdeModulePkg/Core/Dxe/Mem/HeapGuard.c | 4 +++-
MdeModulePkg/Core/PiSmmCore/HeapGuard.c | 8 ++++++--
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c b/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
index 30a73fc04d..3a829854af 100644
--- a/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
+++ b/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
@@ -1110,7 +1110,9 @@ DumpGuardedMemoryBitmap (
CHAR8 *Ruler1;
CHAR8 *Ruler2;
- if (mGuardedMemoryMap == 0) {
+ if (mGuardedMemoryMap == 0 ||
+ mMapLevel == 0 ||
+ mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {
return;
}
diff --git a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
index 7dbbf79dc0..1d5fb8cdb5 100644
--- a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
+++ b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
@@ -1170,7 +1170,9 @@ SetAllGuardPages (
UINTN Index;
BOOLEAN OnGuarding;
- if (mGuardedMemoryMap == 0) {
+ if (mGuardedMemoryMap == 0 ||
+ mMapLevel == 0 ||
+ mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {
return;
}
@@ -1329,7 +1331,9 @@ DumpGuardedMemoryBitmap (
CHAR8 *Ruler1;
CHAR8 *Ruler2;
- if (mGuardedMemoryMap == 0) {
+ if (mGuardedMemoryMap == 0 ||
+ mMapLevel == 0 ||
+ mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {
return;
}
--
2.14.1.windows.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] MdeModulePkg/Core: Fix potential array overflow
2017-11-23 1:06 [PATCH] MdeModulePkg/Core: Fix potential array overflow Jian J Wang
@ 2017-11-23 1:38 ` Wu, Hao A
0 siblings, 0 replies; 2+ messages in thread
From: Wu, Hao A @ 2017-11-23 1:38 UTC (permalink / raw)
To: Wang, Jian J, edk2-devel@lists.01.org; +Cc: Zeng, Star, Dong, Eric
Reviewed-by: Hao Wu <hao.a.wu@intel.com>
Best Regards,
Hao Wu
> -----Original Message-----
> From: Wang, Jian J
> Sent: Thursday, November 23, 2017 9:06 AM
> To: edk2-devel@lists.01.org
> Cc: Wu, Hao A; Zeng, Star; Dong, Eric
> Subject: [PATCH] MdeModulePkg/Core: Fix potential array overflow
>
> In the method DumpGuardedMemoryBitmap() and SetAllGuardPages(), the
> code
> didn't check if the global mMapLevel is legal value or not, which leaves
> a logic hole causing potential array overflow in code followed.
>
> This patch adds sanity check before any array reference in those methods.
>
> Cc: Wu Hao <hao.a.wu@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> ---
> MdeModulePkg/Core/Dxe/Mem/HeapGuard.c | 4 +++-
> MdeModulePkg/Core/PiSmmCore/HeapGuard.c | 8 ++++++--
> 2 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
> b/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
> index 30a73fc04d..3a829854af 100644
> --- a/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
> +++ b/MdeModulePkg/Core/Dxe/Mem/HeapGuard.c
> @@ -1110,7 +1110,9 @@ DumpGuardedMemoryBitmap (
> CHAR8 *Ruler1;
> CHAR8 *Ruler2;
>
> - if (mGuardedMemoryMap == 0) {
> + if (mGuardedMemoryMap == 0 ||
> + mMapLevel == 0 ||
> + mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {
> return;
> }
>
> diff --git a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
> b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
> index 7dbbf79dc0..1d5fb8cdb5 100644
> --- a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
> +++ b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
> @@ -1170,7 +1170,9 @@ SetAllGuardPages (
> UINTN Index;
> BOOLEAN OnGuarding;
>
> - if (mGuardedMemoryMap == 0) {
> + if (mGuardedMemoryMap == 0 ||
> + mMapLevel == 0 ||
> + mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {
> return;
> }
>
> @@ -1329,7 +1331,9 @@ DumpGuardedMemoryBitmap (
> CHAR8 *Ruler1;
> CHAR8 *Ruler2;
>
> - if (mGuardedMemoryMap == 0) {
> + if (mGuardedMemoryMap == 0 ||
> + mMapLevel == 0 ||
> + mMapLevel > GUARDED_HEAP_MAP_TABLE_DEPTH) {
> return;
> }
>
> --
> 2.14.1.windows.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-11-23 1:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-11-23 1:06 [PATCH] MdeModulePkg/Core: Fix potential array overflow Jian J Wang
2017-11-23 1:38 ` Wu, Hao A
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox