From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.93, mailfrom: chao.b.zhang@intel.com) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by groups.io with SMTP; Thu, 27 Jun 2019 16:29:38 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Jun 2019 16:29:38 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,425,1557212400"; d="scan'208";a="153206884" Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by orsmga007.jf.intel.com with ESMTP; 27 Jun 2019 16:29:37 -0700 Received: from shsmsx105.ccr.corp.intel.com (10.239.4.158) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 27 Jun 2019 16:29:37 -0700 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.33]) by SHSMSX105.ccr.corp.intel.com ([169.254.11.72]) with mapi id 14.03.0439.000; Fri, 28 Jun 2019 07:29:35 +0800 From: "Zhang, Chao B" To: "Xu, Wei6" , "devel@edk2.groups.io" CC: "Wang, Jian J" , "Wu, Hao A" Subject: Re: [edk2-devel][Patch] MdeModulePkg/DxeCapsuleLibFmp: Add missing NULL pointer check. Thread-Topic: [edk2-devel][Patch] MdeModulePkg/DxeCapsuleLibFmp: Add missing NULL pointer check. Thread-Index: AQHVLQUbeCzhVYr4x0KDuJu849uUa6awJjEg Date: Thu, 27 Jun 2019 23:29:35 +0000 Message-ID: References: <20190627162629.16352-1-wei6.xu@intel.com> In-Reply-To: <20190627162629.16352-1-wei6.xu@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ctpclassification: CTP_NT x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMzNiYmU0ZjAtMmFjYi00NjMyLTgxYTctZjQ1MDg2NWZmNmQyIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiN1JFZDhPM2VHcGxSVzdJOTNBRDF6UnY4c2U5WDNPYSs5K05yV1F1NjkyQWJoWVdsTDJkK3hcLzdSMnFpWlwvWlc5In0= dlp-product: dlpe-windows dlp-version: 11.0.600.7 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: chao.b.zhang@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Chao Zhang -----Original Message----- From: Xu, Wei6=20 Sent: Friday, June 28, 2019 12:26 AM To: devel@edk2.groups.io Cc: Wang, Jian J ; Wu, Hao A ; Z= hang, Chao B Subject: [edk2-devel][Patch] MdeModulePkg/DxeCapsuleLibFmp: Add missing NUL= L pointer check. Add missing NULL pointer check for CapsuleNameBufStart. Also add comments to notice that capsule name integrity check assumes the c= apsule has been validated by IsValidCapsuleHeader(). Cc: Jian J Wang Cc: Hao A Wu Cc: Chao B Zhang Signed-off-by: Wei6 Xu --- MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c b/MdeMod= ulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c index 66c9be8e1f..3193ca8f4d 100644 --- a/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c +++ b/MdeModulePkg/Library/DxeCapsuleLibFmp/CapsuleOnDisk.c @@ -23,10 +23,13 @@ IsCapsuleNameCapsule ( =20 /** Check the integrity of the capsule name capsule. If the capsule is vaild, return the physical address of each capsule nam= e string. =20 + This routine assumes the capsule has been validated by=20 + IsValidCapsuleHeader(), so capsule memory overflow is not going to happe= n in this routine. + @param[in] CapsuleHeader Pointer to the capsule header of a capsule n= ame capsule. @param[out] CapsuleNameNum Number of capsule name. =20 @retval NULL Capsule name capsule is not valid. @retval CapsuleNameBuf Array of capsule name physical address. @@ -63,10 +66,13 @@ ValidateCapsuleNameCapsuleIntegrity ( // // If strings are not aligned on a 16-bit boundary, reallocate memory fo= r it. // if (((UINTN) CapsuleNameBufStart & BIT0) !=3D 0) { CapsuleNameBufStart =3D AllocateCopyPool (CapsuleHeader->CapsuleImageS= ize - CapsuleHeader->HeaderSize, CapsuleNameBufStart); + if (CapsuleNameBufStart =3D=3D NULL) { + return NULL; + } } =20 CapsuleNameBufEnd =3D CapsuleNameBufStart + CapsuleHeader->CapsuleImageS= ize - CapsuleHeader->HeaderSize; =20 CapsuleNamePtr =3D CapsuleNameBufStart; -- 2.16.2.windows.1