From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 4849F7803CE for ; Fri, 12 Jan 2024 11:43:09 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=+uzdnrT9X0SFkCmnuts/OHmB8s8ygCIW7zc9iLrGvpk=; c=relaxed/simple; d=groups.io; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:From:To:CC:Subject:Thread-Topic:Thread-Index:Date:Message-ID:References:In-Reply-To:Accept-Language:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type; s=20140610; t=1705059788; v=1; b=oE9cFj8rZW4YRe4bRU7o1q7bLUCIyJKMEZTuqyiwjjackzuUueli2HRsgMdQ4TRxfNM2R/Xj M0+UfCwXXXgCRUrB+z14KdStDfFAa5qqdGZ8A0YTd4WT4vrkf0NYCIFSIb5HJEAzPUU5a6hV2qO OJReOfGMwHJndrmxXIClYBbA= X-Received: by 127.0.0.2 with SMTP id aldbYY7687511xPvhGkWIFCk; Fri, 12 Jan 2024 03:43:08 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.65]) by mx.groups.io with SMTP id smtpd.web10.5295.1705059787186633860 for ; Fri, 12 Jan 2024 03:43:07 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10950"; a="402921293" X-IronPort-AV: E=Sophos;i="6.04,189,1695711600"; d="scan'208,217";a="402921293" X-Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jan 2024 03:43:06 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10950"; a="817048678" X-IronPort-AV: E=Sophos;i="6.04,189,1695711600"; d="scan'208,217";a="817048678" X-Received: from fmsmsx603.amr.corp.intel.com ([10.18.126.83]) by orsmga001.jf.intel.com with ESMTP/TLS/AES256-GCM-SHA384; 12 Jan 2024 03:43:04 -0800 X-Received: from fmsmsx603.amr.corp.intel.com (10.18.126.83) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Fri, 12 Jan 2024 03:43:03 -0800 X-Received: from fmsedg601.ED.cps.intel.com (10.1.192.135) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35 via Frontend Transport; Fri, 12 Jan 2024 03:43:03 -0800 X-Received: from NAM11-CO1-obe.outbound.protection.outlook.com (104.47.56.168) by edgegateway.intel.com (192.55.55.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Fri, 12 Jan 2024 03:43:03 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jMi3wZuHcm7w0jrn6s1qIx/f9Kj8C7xYFuVBUbxe3O45gCBKoFxvEIojqKEulRv1ztj4eLWfmJttav4gGpbcTzutRKeNnwsihrcqmH1cyyWg5WZf9VqIK1RR0zy26p96skxS1zfaeQ7pDVXAE1MQcZtzBZRR20ZRnKhHAqQ/MSI1gYk4mrMW9yebPMcq9gSGEz/3lqNQzugNQWqQMqqVxCF9ErFJLN3upxGLpKnzVcZBtb6s3WubTM9IIJ8c4iU7CifyP5uf4aUUrMG9YyQV8U5ZzvctKJ5pxWT51d80+3azvNnBJfwHIvxw7RG97R5GNv11hcVDiiQWDl3S3EE1aw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=sikrcu8PkIsSWOAhjnzdRKNZDvwzmfmrwLTAdGcKuAw=; b=N8C6g1DtxM0wgvOh1XLn643f9tDtjOzRao7drr4VvRATobBXFy6Xxo5P1fDrIh113fusV9cXTpaeV5BSc07fxt+O6zT6xNT7aZoQTu1B5A2m2p2am2kbc73p+uE2Rt4uN8tnccbZBHyqRUeoXj2iJr/fT+NsorAfXfJQwLHlND6tIG1lMGrvObOckpBMs7HPH9aCb43Bu4jVgd+e+OnKorcJkPUbnePxn46UWgw64w7urS4A3gztArFcxqxxEcLT4ipTkdQW0jVPBnfq769+ldytNk+Q3g9gRvglcPTU5+A4uKLHDzaa7hBNqbLR2CJWU+2A6I61v6sJxg3gteDVbQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none X-Received: from BL1PR11MB5478.namprd11.prod.outlook.com (2603:10b6:208:31d::12) by CH3PR11MB8316.namprd11.prod.outlook.com (2603:10b6:610:17b::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7181.23; Fri, 12 Jan 2024 11:42:59 +0000 X-Received: from BL1PR11MB5478.namprd11.prod.outlook.com ([fe80::1732:8b4d:9f8b:3e2f]) by BL1PR11MB5478.namprd11.prod.outlook.com ([fe80::1732:8b4d:9f8b:3e2f%6]) with mapi id 15.20.7181.020; Fri, 12 Jan 2024 11:42:59 +0000 From: "Guo, Gua" To: "Tan, Lean Sheng" , "Rudolph, Patrick" CC: "devel@edk2.groups.io" , "Rhodes, Sean" , "Lu, James" , "Ni, Ray" , "Dong, Guo" Subject: Re: [edk2-devel] [PATCH] UefiPayloadPkg: CbParseLib: Fix integer overflow Thread-Topic: [PATCH] UefiPayloadPkg: CbParseLib: Fix integer overflow Thread-Index: AQHaRUs0ppX7hE0dfkCyz+QOOZZJ+LDWDkPi Date: Fri, 12 Jan 2024 11:42:59 +0000 Message-ID: References: <48d2fc1437b07b1e815f3ca8cabc9c1a2fc05a87.1704696950.git.patrick.rudolph@9elements.com> In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: BL1PR11MB5478:EE_|CH3PR11MB8316:EE_ x-ms-office365-filtering-correlation-id: a556a357-ac5a-44b0-6fa5-08dc1363a055 x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam-message-info: H4smkErOxl5zJx8sY1dBhphQiRQW50onMr6/VmjHG4RmNXcANJxHpTdX+wXAcH7Bc/wYFIhUT5Rm3AsR2WAITJ6cIQBHu8KZ39iv4XmwlZ2yB/E86ay/xbNF993GMylsP3JQlvJ6zBODkn/rqhkWmy0fOlW9GnvMBz9Rx7+TsJIt9XXFg0JxFQZGqw+blg4RnIb3nRhPJ4yACHdeJwWK00CwKclOwT8Lkdi8JLX3QQ/LulCYzhAE2juVcovxdiVswDlXjSJmY+skn1/wSLr1kFKfk4/fxCsD4ko/v3B9ORK8/03bFktF9+I3ztSCmDJfoirKLNCCPeI/pQS4jRNKJ/v0pn5D6ACaTV4SMwq2vfsck1eYB5GeN3p81KmJHSefqeOdcDAISdgTC4i2J3mwEq3Qj0R0cs+8kY+u2HBzXFAuF+HupENXMNICw+CGQpkH3nCoGk6WgWc4UQtf8h9130TFIF78jpeiPxuIYOKkixgM/FVg0OPXIamgiZcgkbao9G6LqyKcbPhJlXM4xPIW0YGfVFtqQSDi2nC60vbJBrXd3+YPmYnIhN2D/hyE4Hysb0ygjKmpqXQK2Vbmx7mIcRhgtyGf4w7+gohZzauBnUQ= x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?t60JLU0RjwuoHeJ1hlfSjJLmvEybqVKFf4gntcaMccwILHPAr+dO91pMHy?= =?iso-8859-1?Q?ZNjNgdlSc3WJWIGjPFJOCJps5vIsNu2+skrkC2Obtm++BikZy7hu8dREur?= =?iso-8859-1?Q?OcqAaFGRHA7AVxE7TqBnQwi3o0UJ4jizZIv2cWRIFdLgq8UkQZpFNFAlpb?= =?iso-8859-1?Q?UwuiDRlIYtbl2r1PIst2FjDfZ1oOaic93WB157PY7YsZOLJ/+5QcoZUDqm?= =?iso-8859-1?Q?9pJ9u3B6qVSGo2aNnRQTTvi98ZvR0B4bmtpUZzpYIgy4FwS+yjM+Hct1nm?= =?iso-8859-1?Q?b9iLqfpgx6pEeKV8s0sCkZo9wRUcy00iHh/rdZ3cIwZYu+OGQpvr1UaNYu?= =?iso-8859-1?Q?VYd8iPAwBynyZbCstvdilDsN7nIJqjWwcyNh+xTAO9Hk4u76IWp3TMv6eD?= =?iso-8859-1?Q?0ZDpg49W9XtJONoKsjCy/gXEZyPA6/iGA6GiKHaehELgc2mektSBa203/2?= =?iso-8859-1?Q?cpWGSLmYD+P/3NR1Jbq1m7E+OORgIh0FeIvYtAaV05J4Jm98rOayyro4rR?= =?iso-8859-1?Q?Dy2LBC338cd1Cnx1vw2cU9rINLVdcAJHO4mDTmHFKBzdYsPtq7sceFPFiJ?= =?iso-8859-1?Q?EslGUlpkNAZNrs3haHyrwfpw1qLz5L6RR4juIMukbwqjdUQeuYby5YsQWc?= =?iso-8859-1?Q?cTLrtG3BdKdUL5lDKb0SrhQYW7JXaFCom1JlGsH1Ip0dJvkl6Kufe/pq4d?= =?iso-8859-1?Q?MMPdE4pcGVaMqoiPmyxcSoS9wipNluInOzDDpdE3EpqT4DsnA/SoRfyA/c?= =?iso-8859-1?Q?w7ANue4opcQc8gnP0e5NRhmxRz6a0EI1x1vx4+xfYOg+xrPBqIBGDV798p?= =?iso-8859-1?Q?fjfssVK+1k6AQ8z9xMPxyiPw0PbYcS2n0PEQVfAryLbbziCcdCwkXTwNE2?= =?iso-8859-1?Q?gJfB1DPLdtel1xRCe3N3yoSmYi/HFs0eVgrE669WDOB/OhDACUreWU+IhJ?= =?iso-8859-1?Q?cBsn7WGVsoWYLeCiMel1MUtVM2DtqQsoJzVXtERFfZAqJ9cbe6zxBVc8Yd?= =?iso-8859-1?Q?Vrp3RLJguOaQJZVNjWksHaqc9iare2vC8pGdLk20rkDvFC80hjpYWmSa6e?= =?iso-8859-1?Q?KVfTFm4whTMLbxFH9RUhj5n2FPdPti9WaWTLN2zVTydK/SABCB6RZRDtVS?= =?iso-8859-1?Q?UJD+Cjvhzxa2g8iZMVxPm6JRHRTLZbtndwWHhhruFHXSaQT4XSfeDxVekU?= =?iso-8859-1?Q?znVkOW3BNb8e3mtSD5bGmz372ZDeHbQCc9EAWTDSGMHAhyiwc+tZvnlHfk?= =?iso-8859-1?Q?o9E9abypqexa0GmRf+B5E/lMA1X8jS9EsBhpnmYjyk3z5dZHFgH/A+kgWD?= =?iso-8859-1?Q?Tv9NGko+jtwq1wWziyaJa+0WsKJjB965J0BqQE3VOd9InnOhLptS0Ejzy8?= =?iso-8859-1?Q?IY4WbYqOBK2YoAia00hEjDqpbtzuWepA8BvWR/4qgQViu+oXssKNDA/rpP?= =?iso-8859-1?Q?XnOBKv0TfUurUqHVYhChEA4fJv7vVg9ibAPVL3tVwZAbh85tAa4pGam6vM?= =?iso-8859-1?Q?dOmxVIg9tY2A/ovxqyaTga1BTk2h86UWnIo932CXTPdxkjLOy9CY6uiSoD?= =?iso-8859-1?Q?bqcpLtc3zjFBXhqcPp1ndu4vS4DXiPQJ7I9aFhF17lS2CH3QOJIrjvX8kx?= =?iso-8859-1?Q?jdOyRRFOgGXhUE3r7LnFIEd0aGoORRq9ulaVDGRqt7BOFGY1+3EK32Ag?= =?iso-8859-1?Q?=3D=3D?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BL1PR11MB5478.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: a556a357-ac5a-44b0-6fa5-08dc1363a055 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jan 2024 11:42:59.2239 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: F40ZexCm69bYMQx/x5kncj9b5xUBBoX+OyrIPzO8WIWuTqPHP04/swn7z9kJG0spt/iTaE8EYigZpNS8X4HoWQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR11MB8316 X-OriginatorOrg: intel.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,gua.guo@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: 8MPTaRVCLupEs868dNz0e0OYx7686176AA= Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_BL1PR11MB54783E6F473353EA0022CA6EEF6F2BL1PR11MB5478namp_" X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=oE9cFj8r; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}"); dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io --_000_BL1PR11MB54783E6F473353EA0022CA6EEF6F2BL1PR11MB5478namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Reviewed-by: Gua Guo ________________________________ From: Lean Sheng Tan Sent: Friday, January 12, 2024 7:33:00 PM To: Rudolph, Patrick Cc: devel@edk2.groups.io ; Rhodes, Sean ; Guo, Gua ; Lu, James ; N= i, Ray ; Dong, Guo Subject: Re: [PATCH] UefiPayloadPkg: CbParseLib: Fix integer overflow Hi Gua or Sean, Would you mind to help review this? Thanks! Best Regards, Lean Sheng Tan [http://static.9elements.com/logo-signature.png] 9elements GmbH, Kortumstra=DFe 19-21, 44787 Bochum, Germany Email: sheng.tan@9elements.com Phone: +49 234 68 94 188 Mobile: +49 176 76 113842 Registered office: Bochum Commercial register: Amtsgericht Bochum, HRB 17519 Management: Sebastian German, Eray Bazaar Data protection information according to Art. 13 GDPR On Mon, 8 Jan 2024 at 08:00, Patrick Rudolph > wrote: The IMD entry uses the 32bit start field as relative offset to root. On Ia32X64 this works fine as UINTN is also 32 bit and negative relative offsets are properly calculated due to an integer overflow. On X64 this doesn't work as UINTN is 64 bit and the offset is no longer subtracted, but it's added to the root. Fix that by sign extending the start field to 64 bit. Test: Booting UefiPayloadPkg still works on Ia32X64 and now also works on X64. Signed-off-by: Patrick Rudolph > --- UefiPayloadPkg/Library/CbParseLib/CbParseLib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c b/UefiPayloadPk= g/Library/CbParseLib/CbParseLib.c index 8a353f77f6..9e149532a7 100644 --- a/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c +++ b/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c @@ -282,7 +282,7 @@ FindCbMemTable ( for (Idx =3D 0; Idx < Root->num_entries; Idx++) { if (Entries[Idx].id =3D=3D TableId) { if (IsImdEntry) { - *MemTable =3D (VOID *)((UINTN)Entries[Idx].start + (UINTN)Root); + *MemTable =3D (VOID *)((INTN)(INT32)Entries[Idx].start + (UINTN)Ro= ot); } else { *MemTable =3D (VOID *)(UINTN)Entries[Idx].start; } -- 2.43.0 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#113720): https://edk2.groups.io/g/devel/message/113720 Mute This Topic: https://groups.io/mt/103593206/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- --_000_BL1PR11MB54783E6F473353EA0022CA6EEF6F2BL1PR11MB5478namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Reviewed-by: Gua Guo <gua.guo@intel.com>
From: Lean Sheng Tan <sh= eng.tan@9elements.com>
Sent: Friday, January 12, 2024 7:33:00 PM
To: Rudolph, Patrick <patrick.rudolph@9elements.com>
Cc: devel@edk2.groups.io <devel@edk2.groups.io>; Rhodes, Sean = <sean@starlabs.systems>; Guo, Gua <gua.guo@intel.com>; Lu, Jame= s <james.lu@intel.com>; Ni, Ray <ray.ni@intel.com>; Dong, Guo &= lt;guo.dong@intel.com>
Subject: Re: [PATCH] UefiPayloadPkg: CbParseLib: Fix integer overflo= w
 
Hi Gua or Sean,
Would you mind to help review this?
Thanks!

Best Regards,
Lean = Sheng Tan



9elements GmbH, Kortumstra=DFe 19-21, 44787 Bochum, Germany

Registered office: Bochum
Commercial register: Amtsgericht Bo= chum, HRB 17519
Management: Sebastian German, Eray = Bazaar


On Mon, 8 Jan 2024 at 08:00, Patric= k Rudolph <patrick.rudo= lph@9elements.com> wrote:
The IMD entry uses the 32bit start field as relative offset
to root. On Ia32X64 this works fine as UINTN is also 32 bit and
negative relative offsets are properly calculated due to an
integer overflow.

On X64 this doesn't work as UINTN is 64 bit and the offset
is no longer subtracted, but it's added to the root. Fix that
by sign extending the start field to 64 bit.

Test: Booting UefiPayloadPkg still works on Ia32X64 and now also
      works on X64.

Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
---
 UefiPayloadPkg/Library/CbParseLib/CbParseLib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c b/UefiPayloadPk= g/Library/CbParseLib/CbParseLib.c
index 8a353f77f6..9e149532a7 100644
--- a/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c
+++ b/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c
@@ -282,7 +282,7 @@ FindCbMemTable (
   for (Idx =3D 0; Idx < Root->num_entries; Idx++) {
     if (Entries[Idx].id =3D=3D TableId) {
       if (IsImdEntry) {
-        *MemTable =3D (VOID *)((UINTN)Entries[Idx].sta= rt + (UINTN)Root);
+        *MemTable =3D (VOID *)((INTN)(INT32)Entries[Id= x].start + (UINTN)Root);
       } else {
         *MemTable =3D (VOID *)(UINTN)Entries[Idx]= .start;
       }
--
2.43.0

_._,_._,_
Groups.io Links:

=20 You receive all messages sent to this group. =20 =20

View/Reply Online (#113720) | =20 | Mute= This Topic | New Topic
Your Subscriptio= n | Contact Group Owner | Unsubscribe [rebecca@openfw.io]

_._,_._,_
--_000_BL1PR11MB54783E6F473353EA0022CA6EEF6F2BL1PR11MB5478namp_--