From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.120; helo=mga04.intel.com; envelope-from=hao.a.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id D6B8821962301 for ; Mon, 29 Oct 2018 18:01:16 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Oct 2018 18:01:16 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,442,1534834800"; d="scan'208";a="103621511" Received: from fmsmsx107.amr.corp.intel.com ([10.18.124.205]) by fmsmga001.fm.intel.com with ESMTP; 29 Oct 2018 18:01:15 -0700 Received: from fmsmsx113.amr.corp.intel.com (10.18.116.7) by fmsmsx107.amr.corp.intel.com (10.18.124.205) with Microsoft SMTP Server (TLS) id 14.3.408.0; Mon, 29 Oct 2018 18:01:15 -0700 Received: from shsmsx103.ccr.corp.intel.com (10.239.4.69) by FMSMSX113.amr.corp.intel.com (10.18.116.7) with Microsoft SMTP Server (TLS) id 14.3.408.0; Mon, 29 Oct 2018 18:01:15 -0700 Received: from shsmsx104.ccr.corp.intel.com ([169.254.5.117]) by SHSMSX103.ccr.corp.intel.com ([169.254.4.161]) with mapi id 14.03.0415.000; Tue, 30 Oct 2018 09:01:13 +0800 From: "Wu, Hao A" To: Leif Lindholm CC: "Ni, Ruiyu" , Paulo Alcantara , "edk2-devel@lists.01.org" , "Zeng, Star" Thread-Topic: [edk2] [PATCH] MdeModulePkg/UdfDxe: Additional checks for ResolveSymlink() Thread-Index: AQHUbQE3knpy/m7DlUWCN87K+uccVqU1j5sAgAFuEJA= Date: Tue, 30 Oct 2018 01:01:12 +0000 Message-ID: References: <20181026075457.6280-1-hao.a.wu@intel.com> <20181029110930.56pzdhdzhkn2ixcy@bivouac.eciton.net> In-Reply-To: <20181029110930.56pzdhdzhkn2ixcy@bivouac.eciton.net> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH] MdeModulePkg/UdfDxe: Additional checks for ResolveSymlink() X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Oct 2018 01:01:17 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable > -----Original Message----- > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of > Leif Lindholm > Sent: Monday, October 29, 2018 7:10 PM > To: Wu, Hao A > Cc: Ni, Ruiyu; Paulo Alcantara; edk2-devel@lists.01.org; Zeng, Star > Subject: Re: [edk2] [PATCH] MdeModulePkg/UdfDxe: Additional checks for > ResolveSymlink() >=20 > Hi Hao Wu, >=20 > I have no comment about the code changes, but would it be possible to > split this up into three separate patches? They are three separate > changes, but as it stands, it is not _obvious_ that they do not have > interdependencies. Splitting them up would make that immediately > obvious. You already have the three commit messages :) Thanks Leif, Yes, I will send a new series to address it. Best Regards, Hao Wu >=20 > Best Regards, >=20 > Leif >=20 > On Fri, Oct 26, 2018 at 03:54:57PM +0800, Hao Wu wrote: > > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3D1279 > > > > The commit will add 3 types of checks for function ResolveSymlink(): > > > > A. Check for the value of 'Component Type' field within a Path Componen= t > > > > According to the ECMA-167 standard (3rd Edition - June 1997), Section > > 14.16.1.1, valid values are 1 to 5. All other values will be treated as= a > > corrupted volume. > > > > B. Check for the content pointed by 'File' > > > > Since content within 'File' is the output data for ResolveSymlink(). > > Checks is added to ensure the content in 'File' is valid. Otherwise, > > possible null pointer dereference issue will occur during the subsequen= t > > usage of the data returned by ResolveSymlink(). > > > > C. Check for possible memory double free/use after free case > > > > For codes: > > > > if (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent, > > sizeof (UDF_FILE_INFO)) !=3D 0) { > > CleanupFileInformation (&PreviousFile); > > } > > > > CopyMem ((VOID *)&PreviousFile, (VOID *)File, sizeof (UDF_FILE_INFO= )); > > > > If the contents in 'PreviousFile' and 'File' are the same, call to > > "CleanupFileInformation (&PreviousFile);" will free the buffers in 'Fil= e' > > as well. This will lead to potential memory double free/use after free > > issues. > > > > Cc: Paulo Alcantara > > Cc: Paulo Alcantara > > Cc: Ruiyu Ni > > Cc: Star Zeng > > Contributed-under: TianoCore Contribution Agreement 1.1 > > Signed-off-by: Hao Wu > > --- > > .../Universal/Disk/UdfDxe/FileSystemOperations.c | 30 > ++++++++++++++++++++-- > > 1 file changed, 28 insertions(+), 2 deletions(-) > > > > diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c > b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c > > index b9ebddfe62..a89e5ba9ff 100644 > > --- a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c > > +++ b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c > > @@ -2145,6 +2145,8 @@ ResolveSymlink ( > > UINT8 CompressionId; > > UDF_FILE_INFO PreviousFile; > > > > + ZeroMem ((VOID *)File, sizeof (UDF_FILE_INFO)); > > + > > // > > // Symlink files on UDF volumes do not contain so much data other th= an > > // Path Components which resolves to real filenames, so it's OK to r= ead in > > @@ -2257,6 +2259,13 @@ ResolveSymlink ( > > } > > FileName[Index] =3D L'\0'; > > break; > > + default: > > + // > > + // Accoring to the ECMA-167 standard (3rd Edition - June 1997), > Section > > + // 14.16.1.1, all other values are reserved. > > + // > > + Status =3D EFI_VOLUME_CORRUPTED; > > + goto Error_Find_File; > > } > > > > // > > @@ -2281,8 +2290,18 @@ ResolveSymlink ( > > break; > > } > > > > - if (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent, > > - sizeof (UDF_FILE_INFO)) !=3D 0) { > > + // > > + // Check the content in the file info pointed by File. > > + // > > + if ((File->FileEntry =3D=3D NULL) || (File->FileIdentifierDesc =3D= =3D NULL)) { > > + Status =3D EFI_VOLUME_CORRUPTED; > > + goto Error_Find_File; > > + } > > + > > + if ((CompareMem ((VOID *)&PreviousFile, (VOID *)Parent, > > + sizeof (UDF_FILE_INFO)) !=3D 0) && > > + (CompareMem ((VOID *)&PreviousFile, (VOID *)File, > > + sizeof (UDF_FILE_INFO)) !=3D 0)) { > > CleanupFileInformation (&PreviousFile); > > } > > > > @@ -2294,6 +2313,13 @@ ResolveSymlink ( > > // > > FreePool (ReadFileInfo.FileData); > > > > + // > > + // Check the content in the resolved file info. > > + // > > + if ((File->FileEntry =3D=3D NULL) || (File->FileIdentifierDesc =3D= =3D NULL)) { > > + return EFI_VOLUME_CORRUPTED; > > + } > > + > > return EFI_SUCCESS; > > > > Error_Find_File: > > -- > > 2.12.0.windows.1 > > > > _______________________________________________ > > edk2-devel mailing list > > edk2-devel@lists.01.org > > https://lists.01.org/mailman/listinfo/edk2-devel > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel