From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.43, mailfrom: rangasai.v.chaganty@intel.com) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by groups.io with SMTP; Thu, 18 Jul 2019 09:53:40 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Jul 2019 09:53:40 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,278,1559545200"; d="scan'208";a="176063966" Received: from orsmsx103.amr.corp.intel.com ([10.22.225.130]) by FMSMGA003.fm.intel.com with ESMTP; 18 Jul 2019 09:53:34 -0700 Received: from orsmsx125.amr.corp.intel.com (10.22.240.125) by ORSMSX103.amr.corp.intel.com (10.22.225.130) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 18 Jul 2019 09:53:33 -0700 Received: from orsmsx107.amr.corp.intel.com ([169.254.1.186]) by ORSMSX125.amr.corp.intel.com ([169.254.3.92]) with mapi id 14.03.0439.000; Thu, 18 Jul 2019 09:53:33 -0700 From: "Chaganty, Rangasai V" To: "Desimone, Nathaniel L" , "devel@edk2.groups.io" CC: "Chiu, Chasel" , "Kubacki, Michael A" Subject: Re: [edk2-platforms] [PATCH v2] KabylakeSiliconPkg: Possible out-of-bounds memory writes Thread-Topic: [edk2-platforms] [PATCH v2] KabylakeSiliconPkg: Possible out-of-bounds memory writes Thread-Index: AQHVPTTn+YN6AFInFkqcFt79bVUUk6bQDyvQ Date: Thu, 18 Jul 2019 16:53:33 +0000 Message-ID: References: <20190718064834.18100-1-nathaniel.l.desimone@intel.com> In-Reply-To: <20190718064834.18100-1-nathaniel.l.desimone@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiN2FlZGYwOTctMDVkOS00YTU5LWJmZTktNjAzMWQ1NDk1ODVjIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoid1ozbWtYNU5lSlA4a3NRY29CS0FNbStnVk8rYmk1Y0dwb1lkQ1o5ZG15TmVldm5EbDhYZjIwOGcwUGlpQW9OciJ9 x-ctpclassification: CTP_NT x-originating-ip: [10.22.254.139] MIME-Version: 1.0 Return-Path: rangasai.v.chaganty@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Sai Chaganty =20 -----Original Message----- From: Desimone, Nathaniel L=20 Sent: Wednesday, July 17, 2019 11:49 PM To: devel@edk2.groups.io Cc: Chiu, Chasel ; Kubacki, Michael A ; Chaganty, Rangasai V Subject: [edk2-platforms] [PATCH v2] KabylakeSiliconPkg: Possible out-of-bo= unds memory writes - Add check for the DSDT not existing. - Fixed logic errors in loop boundary check. Cc: Chasel Chiu Cc: Michael A Kubacki Cc: Sai Chaganty Co-authored-by: John Mathews Signed-off-by: Nate DeSimone --- .../Library/DxeAslUpdateLib/DxeAslUpdateLib.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/Silicon/Intel/KabylakeSiliconPkg/Library/DxeAslUpdateLib/DxeAs= lUpdateLib.c b/Silicon/Intel/KabylakeSiliconPkg/Library/DxeAslUpdateLib/Dxe= AslUpdateLib.c index e6ab43db6d..87c6b15ed2 100644 --- a/Silicon/Intel/KabylakeSiliconPkg/Library/DxeAslUpdateLib/DxeAslUpdate= Lib.c +++ b/Silicon/Intel/KabylakeSiliconPkg/Library/DxeAslUpdateLib/DxeAslUpd +++ ateLib.c @@ -6,7 +6,7 @@ =20 This library uses the ACPI Support protocol. =20 -Copyright (c) 2017, Intel Corporation. All rights reserved.
+Copyright (c) 2017 - 2019, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent =20 **/ @@ -59,6 +59,7 @@ InitializeAslUpdateLib ( @param[in] Length - length of data to be overwritten =20 @retval EFI_SUCCESS - The function completed successfully. + @retval EFI_NOT_FOUND - Failed to locate AcpiTable. **/ EFI_STATUS UpdateNameAslCode ( @@ -72,6 +73,7 @@ UpdateNameAslCode ( UINT8 *CurrPtr; UINT32 *Signature; UINT8 *DsdtPointer; + UINT8 *EndPointer; UINTN Handle; UINT8 DataSize; =20 @@ -99,11 +101,15 @@ UpdateNameAslCode ( /// Point to the beginning of the DSDT table /// CurrPtr =3D (UINT8 *) Table; + if (CurrPtr =3D=3D NULL) { + return EFI_NOT_FOUND; + } =20 /// /// Loop through the ASL looking for values that we must fix up. /// - for (DsdtPointer =3D CurrPtr; DsdtPointer <=3D (CurrPtr + ((EFI_ACPI_COM= MON_HEADER *) CurrPtr)->Length); DsdtPointer++) { + EndPointer =3D CurrPtr + ((EFI_ACPI_COMMON_HEADER *) CurrPtr)->Length; = =20 + for (DsdtPointer =3D CurrPtr; DsdtPointer < EndPointer; DsdtPointer++) { /// /// Get a pointer to compare for signature /// -- 2.17.1.windows.2