From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by mx.groups.io with SMTP id smtpd.web10.3039.1581662742663565299 for ; Thu, 13 Feb 2020 22:45:42 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.126, mailfrom: eric.dong@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 Feb 2020 22:45:42 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,439,1574150400"; d="scan'208";a="227500923" Received: from fmsmsx108.amr.corp.intel.com ([10.18.124.206]) by orsmga008.jf.intel.com with ESMTP; 13 Feb 2020 22:45:41 -0800 Received: from fmsmsx113.amr.corp.intel.com (10.18.116.7) by FMSMSX108.amr.corp.intel.com (10.18.124.206) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 13 Feb 2020 22:45:41 -0800 Received: from shsmsx104.ccr.corp.intel.com (10.239.4.70) by FMSMSX113.amr.corp.intel.com (10.18.116.7) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 13 Feb 2020 22:45:40 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.126]) by SHSMSX104.ccr.corp.intel.com ([169.254.5.5]) with mapi id 14.03.0439.000; Fri, 14 Feb 2020 14:45:39 +0800 From: "Dong, Eric" To: "Bi, Dandan" , "devel@edk2.groups.io" CC: "Gao, Liming" , "Wang, Jian J" Subject: Re: [patch 2/2] MdeModulePkg/DisplayEngine: Zero memory before free (CVE-2019-14558) Thread-Topic: [patch 2/2] MdeModulePkg/DisplayEngine: Zero memory before free (CVE-2019-14558) Thread-Index: AQHV4iKWevpfOlBFQUusnJ0aCEyR16gaQFLA Date: Fri, 14 Feb 2020 06:45:38 +0000 Message-ID: References: <20200213040303.53336-1-dandan.bi@intel.com> <20200213040303.53336-3-dandan.bi@intel.com> In-Reply-To: <20200213040303.53336-3-dandan.bi@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiYmMyZTM5NjAtZGYxMC00MzA0LTgyNjUtMGE1NDhkZTI0YjU5IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoibm1BazhQaEI0b2pZc3RHRlpZK05sUjZZQ2hWK0tjMVpiQWlGVTcwM0ZkaWJHSWd6T1l4bVdpRjB1WlI1RGx2ayJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: eric.dong@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Eric Dong -----Original Message----- From: Bi, Dandan =20 Sent: Thursday, February 13, 2020 12:03 PM To: devel@edk2.groups.io Cc: Gao, Liming ; Dong, Eric ; W= ang, Jian J Subject: [patch 2/2] MdeModulePkg/DisplayEngine: Zero memory before free (C= VE-2019-14558) REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1611 Cc: Liming Gao Cc: Eric Dong Cc: Jian J Wang Signed-off-by: Dandan Bi --- MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c b/Mde= ModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c index 7d9486112b..1087004939 100644 --- a/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c +++ b/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c @@ -821,10 +821,11 @@ PasswordProcess ( // // Old password exist, ask user for the old password // Status =3D ReadString (MenuOption, gPromptForPassword, StringPtr); if (EFI_ERROR (Status)) { + ZeroMem (StringPtr, (Maximum + 1) * sizeof (CHAR16)); FreePool (StringPtr); return Status; } =20 // @@ -838,11 +839,11 @@ PasswordProcess ( // PasswordInvalid (); } else { Status =3D EFI_SUCCESS; } - + ZeroMem (StringPtr, (Maximum + 1) * sizeof (CHAR16)); FreePool (StringPtr); return Status; } } =20 @@ -854,10 +855,11 @@ PasswordProcess ( if (EFI_ERROR (Status)) { // // Reset state machine for password // Question->PasswordCheck (gFormData, Question, NULL); + ZeroMem (StringPtr, (Maximum + 1) * sizeof (CHAR16)); FreePool (StringPtr); return Status; } =20 // @@ -869,10 +871,12 @@ PasswordProcess ( if (EFI_ERROR (Status)) { // // Reset state machine for password // Question->PasswordCheck (gFormData, Question, NULL); + ZeroMem (StringPtr, (Maximum + 1) * sizeof (CHAR16)); + ZeroMem (TempString, (Maximum + 1) * sizeof (CHAR16)); FreePool (StringPtr); FreePool (TempString); return Status; } =20 --=20 2.18.0.windows.1