From: "Yao, Jiewen" <jiewen.yao@intel.com>
To: "mikuback@linux.microsoft.com" <mikuback@linux.microsoft.com>,
"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: Erich McMillan <emcmillan@microsoft.com>,
"Jiang, Guomin" <guomin.jiang@intel.com>,
"Wang, Jian J" <jian.j.wang@intel.com>,
"Lu, Xiaoyu1" <xiaoyu1.lu@intel.com>
Subject: Re: [PATCH v2 04/12] CryptoPkg: Fix conditionally uninitialized variable
Date: Thu, 1 Dec 2022 08:28:30 +0000 [thread overview]
Message-ID: <MW4PR11MB58721A49E80FA314813C1D0D8C149@MW4PR11MB5872.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20221129173246.2182-5-mikuback@linux.microsoft.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
> -----Original Message-----
> From: mikuback@linux.microsoft.com <mikuback@linux.microsoft.com>
> Sent: Wednesday, November 30, 2022 1:33 AM
> To: devel@edk2.groups.io
> Cc: Erich McMillan <emcmillan@microsoft.com>; Jiang, Guomin
> <guomin.jiang@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Yao,
> Jiewen <jiewen.yao@intel.com>; Michael Kubacki
> <mikuback@linux.microsoft.com>; Lu, Xiaoyu1 <xiaoyu1.lu@intel.com>
> Subject: [PATCH v2 04/12] CryptoPkg: Fix conditionally uninitialized
> variable
>
> From: Michael Kubacki <michael.kubacki@microsoft.com>
>
> Fixes CodeQL alerts for CWE-457:
> https://cwe.mitre.org/data/definitions/457.html
>
> Checks the return value from `ASN1_get_object()` to verify values
> set by the function are valid.
>
> Note that the function returns literal `0x80`:
> `return (0x80);`
>
> That is used to check the return value is as the case in other areas
> of the code.
>
> Cc: Erich McMillan <emcmillan@microsoft.com>
> Cc: Guomin Jiang <guomin.jiang@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Michael Kubacki <mikuback@linux.microsoft.com>
> Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
> Co-authored-by: Erich McMillan <emcmillan@microsoft.com>
> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
> ---
> CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c | 21 +++++++++++---------
> 1 file changed, 12 insertions(+), 9 deletions(-)
>
> diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
> b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
> index 2333157e0d17..1182323b63ee 100644
> --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
> +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
> @@ -807,6 +807,7 @@ X509GetTBSCert (
> UINT32 Asn1Tag;
> UINT32 ObjClass;
> UINTN Length;
> + UINTN Inf;
>
> //
> // Check input parameters.
> @@ -836,9 +837,9 @@ X509GetTBSCert (
> //
> Temp = Cert;
> Length = 0;
> - ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int
> *)&ObjClass, (long)CertSize);
> + Inf = ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int
> *)&ObjClass, (long)CertSize);
>
> - if (Asn1Tag != V_ASN1_SEQUENCE) {
> + if (((Inf & 0x80) == 0x00) && (Asn1Tag != V_ASN1_SEQUENCE)) {
> return FALSE;
> }
>
> @@ -848,7 +849,7 @@ X509GetTBSCert (
> //
> // Verify the parsed TBSCertificate is one correct SEQUENCE data.
> //
> - if (Asn1Tag != V_ASN1_SEQUENCE) {
> + if (((Inf & 0x80) == 0x00) && (Asn1Tag != V_ASN1_SEQUENCE)) {
> return FALSE;
> }
>
> @@ -1888,18 +1889,20 @@ Asn1GetTag (
> IN UINT32 Tag
> )
> {
> - UINT8 *PtrOld;
> - INT32 ObjTag;
> - INT32 ObjCls;
> - long ObjLength;
> + UINT8 *PtrOld;
> + INT32 ObjTag;
> + INT32 ObjCls;
> + long ObjLength;
> + UINT32 Inf;
>
> //
> // Save Ptr position
> //
> PtrOld = *Ptr;
>
> - ASN1_get_object ((CONST UINT8 **)Ptr, &ObjLength, &ObjTag, &ObjCls,
> (INT32)(End - (*Ptr)));
> - if ((ObjTag == (INT32)(Tag & CRYPTO_ASN1_TAG_VALUE_MASK)) &&
> + Inf = ASN1_get_object ((CONST UINT8 **)Ptr, &ObjLength, &ObjTag,
> &ObjCls, (INT32)(End - (*Ptr)));
> + if (((Inf & 0x80) == 0x00) &&
> + (ObjTag == (INT32)(Tag & CRYPTO_ASN1_TAG_VALUE_MASK)) &&
> (ObjCls == (INT32)(Tag & CRYPTO_ASN1_TAG_CLASS_MASK)))
> {
> *Length = (UINTN)ObjLength;
> --
> 2.28.0.windows.1
next prev parent reply other threads:[~2022-12-01 8:28 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-29 17:32 [PATCH v2 00/12] Enable New CodeQL Queries Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 01/12] MdeModulePkg/SmbiosDxe: Fix pointer and buffer overflow CodeQL alerts Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 02/12] BaseTools/PatchCheck.py: Add PCCTS to tab exemption list Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 03/12] BaseTools/VfrCompile: Fix potential buffer overwrites Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 04/12] CryptoPkg: Fix conditionally uninitialized variable Michael Kubacki
2022-12-01 8:28 ` Yao, Jiewen [this message]
2022-11-29 17:32 ` [PATCH v2 05/12] MdeModulePkg: Fix conditionally uninitialized variables Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 06/12] MdePkg: " Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 07/12] NetworkPkg: " Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 08/12] PcAtChipsetPkg: " Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 09/12] ShellPkg: " Michael Kubacki
2022-11-30 6:55 ` Gao, Zhichao
2022-11-29 17:32 ` [PATCH v2 10/12] UefiCpuPkg: " Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 11/12] .github/codeql/edk2.qls: Enable CWE 457, 676, and 758 queries Michael Kubacki
2022-11-29 17:32 ` [PATCH v2 12/12] .github/codeql/edk2.qls: Enable CWE 120, 787, and 805 queries Michael Kubacki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=MW4PR11MB58721A49E80FA314813C1D0D8C149@MW4PR11MB5872.namprd11.prod.outlook.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox