Re: [edk2-devel] 回复: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString

["Pedro Falcato" <pedro.falcato@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 4621 bytes --]

Hi Liming,

Thank you for the review. Can we please push this in time for the stable
tag?

Thanks,
Pedro

On Fri, Nov 4, 2022 at 1:22 AM gaoliming via groups.io <gaoliming=
byosoft.com.cn@groups.io> wrote:

> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
>
> > -----邮件原件-----
> > 发件人: Pedro Falcato <pedro.falcato@gmail.com>
> > 发送时间: 2022年11月3日 9:12
> > 收件人: devel@edk2.groups.io
> > 抄送: Pedro Falcato <pedro.falcato@gmail.com>; Vitaly Cheptsov
> > <vit9696@protonmail.com>; Marvin Häuser <mhaeuser@posteo.de>;
> > Michael D Kinney <michael.d.kinney@intel.com>; Liming Gao
> > <gaoliming@byosoft.com.cn>; Zhiguang Liu <zhiguang.liu@intel.com>;
> Jiewen
> > Yao <Jiewen.yao@Intel.com>
> > 主题: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString
> >
> > There was a OOB access in *StrHexTo* functions, when passed strings like
> > "XDEADBEEF".
> >
> > OpenCore folks established an ASAN-equipped project to fuzz Ext4Dxe,
> > which was able to catch these (mostly harmless) issues.
> >
> > Cc: Vitaly Cheptsov <vit9696@protonmail.com>
> > Cc: Marvin Häuser <mhaeuser@posteo.de>
> > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
> > Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
> > Reviewed-by: Jiewen Yao <Jiewen.yao@Intel.com>
> > ---
> >  MdePkg/Library/BaseLib/SafeString.c | 25 +++++++++++++++++++++----
> >  1 file changed, 21 insertions(+), 4 deletions(-)
> >
> > diff --git a/MdePkg/Library/BaseLib/SafeString.c
> > b/MdePkg/Library/BaseLib/SafeString.c
> > index f338a32a3a41..b75b33381732 100644
> > --- a/MdePkg/Library/BaseLib/SafeString.c
> > +++ b/MdePkg/Library/BaseLib/SafeString.c
> > @@ -863,6 +863,9 @@ StrHexToUintnS (
> >    OUT       UINTN   *Data
> >    )
> >  {
> > +  BOOLEAN  FoundLeadingZero;
> > +
> > +  FoundLeadingZero = FALSE;
> >    ASSERT (((UINTN)String & BIT0) == 0);
> >
> >    //
> > @@ -892,12 +895,14 @@ StrHexToUintnS (
> >    //
> >    // Ignore leading Zeros after the spaces
> >    //
> > +
> > +  FoundLeadingZero = *String == L'0';
> >    while (*String == L'0') {
> >      String++;
> >    }
> >
> >    if (CharToUpper (*String) == L'X') {
> > -    if (*(String - 1) != L'0') {
> > +    if (!FoundLeadingZero) {
> >        *Data = 0;
> >        return RETURN_SUCCESS;
> >      }
> > @@ -992,6 +997,9 @@ StrHexToUint64S (
> >    OUT       UINT64  *Data
> >    )
> >  {
> > +  BOOLEAN  FoundLeadingZero;
> > +
> > +  FoundLeadingZero = FALSE;
> >    ASSERT (((UINTN)String & BIT0) == 0);
> >
> >    //
> > @@ -1021,12 +1029,13 @@ StrHexToUint64S (
> >    //
> >    // Ignore leading Zeros after the spaces
> >    //
> > +  FoundLeadingZero = *String == L'0';
> >    while (*String == L'0') {
> >      String++;
> >    }
> >
> >    if (CharToUpper (*String) == L'X') {
> > -    if (*(String - 1) != L'0') {
> > +    if (!FoundLeadingZero) {
> >        *Data = 0;
> >        return RETURN_SUCCESS;
> >      }
> > @@ -2393,6 +2402,9 @@ AsciiStrHexToUintnS (
> >    OUT       UINTN  *Data
> >    )
> >  {
> > +  BOOLEAN  FoundLeadingZero;
> > +
> > +  FoundLeadingZero = FALSE;
> >    //
> >    // 1. Neither String nor Data shall be a null pointer.
> >    //
> > @@ -2420,12 +2432,13 @@ AsciiStrHexToUintnS (
> >    //
> >    // Ignore leading Zeros after the spaces
> >    //
> > +  FoundLeadingZero = *String == '0';
> >    while (*String == '0') {
> >      String++;
> >    }
> >
> >    if (AsciiCharToUpper (*String) == 'X') {
> > -    if (*(String - 1) != '0') {
> > +    if (!FoundLeadingZero) {
> >        *Data = 0;
> >        return RETURN_SUCCESS;
> >      }
> > @@ -2517,6 +2530,9 @@ AsciiStrHexToUint64S (
> >    OUT       UINT64  *Data
> >    )
> >  {
> > +  BOOLEAN  FoundLeadingZero;
> > +
> > +  FoundLeadingZero = FALSE;
> >    //
> >    // 1. Neither String nor Data shall be a null pointer.
> >    //
> > @@ -2544,12 +2560,13 @@ AsciiStrHexToUint64S (
> >    //
> >    // Ignore leading Zeros after the spaces
> >    //
> > +  FoundLeadingZero = *String == '0';
> >    while (*String == '0') {
> >      String++;
> >    }
> >
> >    if (AsciiCharToUpper (*String) == 'X') {
> > -    if (*(String - 1) != '0') {
> > +    if (!FoundLeadingZero) {
> >        *Data = 0;
> >        return RETURN_SUCCESS;
> >      }
> > --
> > 2.38.1
>
>
>
>
>
> 
>
>
>

-- 
Pedro Falcato

[-- Attachment #2: Type: text/html, Size: 7216 bytes --]