From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web10.2529.1572239573533760654 for ; Sun, 27 Oct 2019 22:12:53 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.31, mailfrom: jian.j.wang@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Oct 2019 22:12:53 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,238,1569308400"; d="scan'208";a="282843692" Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by orsmga001.jf.intel.com with ESMTP; 27 Oct 2019 22:12:52 -0700 Received: from fmsmsx113.amr.corp.intel.com (10.18.116.7) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 27 Oct 2019 22:12:52 -0700 Received: from shsmsx151.ccr.corp.intel.com (10.239.6.50) by FMSMSX113.amr.corp.intel.com (10.18.116.7) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 27 Oct 2019 22:12:51 -0700 Received: from shsmsx107.ccr.corp.intel.com ([169.254.9.63]) by SHSMSX151.ccr.corp.intel.com ([169.254.3.149]) with mapi id 14.03.0439.000; Mon, 28 Oct 2019 13:12:50 +0800 From: "Wang, Jian J" To: "devel@edk2.groups.io" , "lersek@redhat.com" CC: David Woodhouse , "Wu, Jiaxin" , Sivaraman Nainar , "Lu, XiaoyuX" Subject: Re: [edk2-devel] [PATCH v2 3/8] CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553) Thread-Topic: [edk2-devel] [PATCH v2 3/8] CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553) Thread-Index: AQHVi7+A/YrG1FhpM06wZVEphxKnpqdvhRvQ Date: Mon, 28 Oct 2019 05:12:49 +0000 Message-ID: References: <20191026053719.10453-1-lersek@redhat.com> <20191026053719.10453-4-lersek@redhat.com> In-Reply-To: <20191026053719.10453-4-lersek@redhat.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiYzVkNWY5MzAtNDM3NC00ZTc0LTgxMjgtNzlmMWY4Y2VmNTcxIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiRjdjTk9qRjdDWGJWdlowQ29WNlhndStlcFZqcE1NdkRJbWQrRFdKR1BBWk5ybjJId3pBUnpFWXpTT3hJZ1A4NSJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jian.j.wang@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Jian J Wang Regards, Jian > -----Original Message----- > From: devel@edk2.groups.io On Behalf Of Laszlo Er= sek > Sent: Saturday, October 26, 2019 1:37 PM > To: edk2-devel-groups-io > Cc: David Woodhouse ; Wang, Jian J > ; Wu, Jiaxin ; Sivaraman Nai= nar > ; Lu, XiaoyuX > Subject: [edk2-devel] [PATCH v2 3/8] CryptoPkg/Crt: turn strchr() into a= function > (CVE-2019-14553) >=20 > According to the ISO C standard, strchr() is a function. We #define it a= s > a macro. Unfortunately, our macro evaluates the first argument ("str") > twice. If the expression passed for "str" has side effects, the behavior > may be undefined. >=20 > In a later patch in this series, we're going to resurrect "inet_pton.c" > (originally from the StdLib package), which calls strchr() just like tha= t: >=20 > strchr((xdigits =3D xdigits_l), ch) > strchr((xdigits =3D xdigits_u), ch) >=20 > To enable this kind of function call, turn strchr() into a function. >=20 > Cc: David Woodhouse > Cc: Jian J Wang > Cc: Jiaxin Wu > Cc: Sivaraman Nainar > Cc: Xiaoyu Lu > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3D960 > CVE: CVE-2019-14553 > Signed-off-by: Laszlo Ersek > --- >=20 > Notes: > v2: > - new patch >=20 > CryptoPkg/Library/Include/CrtLibSupport.h | 2 +- > CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c | 5 +++++ > 2 files changed, 6 insertions(+), 1 deletion(-) >=20 > diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h > b/CryptoPkg/Library/Include/CrtLibSupport.h > index 5806f50f7485..b90da20ff7e7 100644 > --- a/CryptoPkg/Library/Include/CrtLibSupport.h > +++ b/CryptoPkg/Library/Include/CrtLibSupport.h > @@ -146,8 +146,9 @@ int isalnum (int); > int isupper (int); > int tolower (int); > int strcmp (const char *, const char *); > int strncasecmp (const char *, const char *, size_t); > +char *strchr (const char *, int); > char *strrchr (const char *, int); > unsigned long strtoul (const char *, char **, int); > long strtol (const char *, char **, int); > char *strerror (int); > @@ -187,9 +188,8 @@ void abort (void); > #define strlen(str) (size_t)(AsciiStrnLenS(str,MA= X_STRING_SIZE)) > #define strcpy(strDest,strSource) > AsciiStrCpyS(strDest,MAX_STRING_SIZE,strSource) > #define strncpy(strDest,strSource,count) > AsciiStrnCpyS(strDest,MAX_STRING_SIZE,strSource,(UINTN)count) > #define strcat(strDest,strSource) > AsciiStrCatS(strDest,MAX_STRING_SIZE,strSource) > -#define strchr(str,ch) ScanMem8((VOID > *)(str),AsciiStrSize(str),(UINT8)ch) > #define strncmp(string1,string2,count) > (int)(AsciiStrnCmp(string1,string2,(UINTN)(count))) > #define strcasecmp(str1,str2) (int)AsciiStriCmp(str1,str2) > #define sprintf(buf,...) > AsciiSPrint(buf,MAX_STRING_SIZE,__VA_ARGS__) > #define localtime(timer) NULL > diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c > b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c > index 71a2ef34ed2b..42235ab96ac3 100644 > --- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c > +++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c > @@ -114,8 +114,13 @@ QuickSortWorker ( > // > // -- String Manipulation Routines -- > // >=20 > +char *strchr(const char *str, int ch) > +{ > + return ScanMem8 (str, AsciiStrSize (str), (UINT8)ch); > +} > + > /* Scan a string for the last occurrence of a character */ > char *strrchr (const char *str, int c) > { > char * save; > -- > 2.19.1.3.g30247aa5d201 >=20 >=20 >=20 >=20