From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by mx.groups.io with SMTP id smtpd.web11.23835.1664156705730378437 for ; Sun, 25 Sep 2022 18:45:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=KfyYo31S; spf=pass (domain: intel.com, ip: 192.55.52.93, mailfrom: jiewen.yao@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1664156705; x=1695692705; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=5//9UHoxtLiPwPZzyWKuzDoEXXKEIFuQDotP995c0o8=; b=KfyYo31S6osLuU9XiV2KkemQ2Ulx+ZiyaHQ0cKEFP0VKGzD8mP8Chb3/ Tak+8B6luaqXxNLhVbVpSsaOoug2tKdOuQhkja4nfCt6GKSUkfk8qv9X5 EW831JcNOEPQ2R4It0en3Xy1hs1/gpMGVrCAZxVlxPrg6uPfUsXCaoseu /XyOrM1N848MN0Uv9eot7N8dLaqHjCiVtPoiX7bs/EnvAnwiKvPnRS6nX nA7w3aExCp9PlUL0pkdFu08BCdRx2AJT8jZkmCwax1aAmi/MwuhdZbbId O8HgCKteTZ8r1F+wR+p95rBNJHwQiX1xkEKz3BskUU1xn9s1Foj5+HDaF g==; X-IronPort-AV: E=McAfee;i="6500,9779,10481"; a="298516446" X-IronPort-AV: E=Sophos;i="5.93,345,1654585200"; d="scan'208";a="298516446" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Sep 2022 18:45:05 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.93,345,1654585200"; d="scan'208";a="620870739" Received: from fmsmsx601.amr.corp.intel.com ([10.18.126.81]) by orsmga002.jf.intel.com with ESMTP; 25 Sep 2022 18:45:04 -0700 Received: from fmsmsx611.amr.corp.intel.com (10.18.126.91) by fmsmsx601.amr.corp.intel.com (10.18.126.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Sun, 25 Sep 2022 18:45:04 -0700 Received: from fmsmsx602.amr.corp.intel.com (10.18.126.82) by fmsmsx611.amr.corp.intel.com (10.18.126.91) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Sun, 25 Sep 2022 18:45:03 -0700 Received: from FMSEDG603.ED.cps.intel.com (10.1.192.133) by fmsmsx602.amr.corp.intel.com (10.18.126.82) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31 via Frontend Transport; Sun, 25 Sep 2022 18:45:03 -0700 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (104.47.55.100) by edgegateway.intel.com (192.55.55.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2375.31; Sun, 25 Sep 2022 18:45:03 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=AY3Y8BIqJB4cojWiJXvuIEUOFf3TyOQ2WSr2lj0+6tAYUQ1Gcb4zGHS5sCfg7S3ibRB89vi6/dMOQTFDIJUfruJFSj3k9S36Bfd/hVKBmc+SKTBW45WMOrLTgmagiv9lfVvAtypoJkVCYZJrR+oks7J/TgjwB8H6vMFykWRD9Ao6BeiYQstXd2R0D6eSbCT+uu1am3UL8SuiclJtKjBPdun0RN711J3BpXGxpxbz+olc76syErH54RUMiQhROtkiybfPZzqgWK0tsh3HElHMWGxTV7uX/Gqc3qmg2YN4mUr/bKHkSkqIIYdqhfxes7eZz+bN+Y4sVShenv/MNhrcdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DMmoIN57wljaZhSp03T6cdoDkDoT+DWKPl+BT4kSvuY=; b=iGQ3CgnIWq72vOVwLRNKYCpI0oRGnxrLDYXL4Vq3uRwn4ACX8H8JuUS0E1T+2z9k+3flLJ2pPKZtIYJY05bazZv3YyvLzcU2u/gRagVfpU4u35vLZOFYt0Lug6bQvwEJIPD2txXFIWIt0xuvTr082etbgkOR/c4/rZJVaZNgeMgZxd9rLtNejN/pUm+xW9j0Z5iwI6aY5uCCjZLJFD/C98n/h94wzxz7rPpwZ6gJ23JBIZn/AP+nZOa+W8f6OdbcHWfo6ANLMHCXsO8G1P0f/8CfJDFSz+zvkWzNuTB+A/JjbElp5JhOCsEiNg20I5cJEzWqTDcRotmg2PN25RfnZA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none Received: from MW4PR11MB5872.namprd11.prod.outlook.com (2603:10b6:303:169::14) by PH0PR11MB4935.namprd11.prod.outlook.com (2603:10b6:510:35::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5654.25; Mon, 26 Sep 2022 01:45:02 +0000 Received: from MW4PR11MB5872.namprd11.prod.outlook.com ([fe80::c17d:f1c9:e958:b5e]) by MW4PR11MB5872.namprd11.prod.outlook.com ([fe80::c17d:f1c9:e958:b5e%6]) with mapi id 15.20.5654.024; Mon, 26 Sep 2022 01:45:02 +0000 From: "Yao, Jiewen" To: "Li, Yi1" , "devel@edk2.groups.io" CC: "Wang, Jian J" , "Lu, Xiaoyu1" , "Jiang, Guomin" Subject: Re: [PATCH V2 1/1] CryptoPkg: Fix pem heap-buffer-overflow due to BIO_snprintf() Thread-Topic: [PATCH V2 1/1] CryptoPkg: Fix pem heap-buffer-overflow due to BIO_snprintf() Thread-Index: AQHY0T5jweBmWe9Po06UaOEPmGXtIq3w8KQw Date: Mon, 26 Sep 2022 01:45:01 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-version: 11.6.500.17 dlp-product: dlpe-windows dlp-reaction: no-action authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: MW4PR11MB5872:EE_|PH0PR11MB4935:EE_ x-ms-office365-filtering-correlation-id: 327eb31b-3b35-4b05-5d8c-08da9f60ba66 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 0p5zn7XrkkNUTEh/5XxXdBXLmlUW36IRciH340gBxgIRPd0YcUFXcuNOSavSNF4Yq64vygL/ieQMRdVQp4IR+/zwLZVIk+PaRXYa5CYYycL2yC/is9CqcHUZM4g8HKg2aHXOiZW9VXNko+LaBSW+KyKuU3nl4+vAVrJhNED2VZ7hEYGrJtviGxxUjUayH5ZCdSeINYp3FxUlI5xV8dldJA3SdtV7za5autAY7cqBBTpaQGWxzTiOEdDG2E4QrNBqGGJP2dRvqD1wEXgLBJpD/Y39N9jJp2Hilc7j9Ir5NOXWQxnTu53+IbTVBe57YJEW2L5ldkHyCKXPtDguv7IMkmBShv8a68U3S8juwXcnkSZZ6DzF2DwKZeFDrVh9ujfQbYOQ2Pu5hJr+nPD900Dw9clF26QiZyo7VltKx/Ai0fQQ5uV5fBhQw763KDVjsqLyeRJ/+UkYCO/ABxnYYrBAj8mCpHWg4EJZEiuiKDwPpdvKZ6tMtDyxS3tumxnFLWuzssXTjBAcjiLTP/J1jhtu3nRWnQ5Wd+K43PD+UETYa86KZsUCRKfmH2bENkB+VEP1+2kGoqPAD3FUrQ+K3jI6hyl4raOjUDgCbs4SJcuwcMDBIdBjo7Gjuj346sngEuHeTKx4HZLnNx751yGKEPx1cnXIbh3Dafc6pH9SevPyX6pgwHXT/nCrOavazvDKzO+d7ElN1dAWsd7SI1NMtMzmS07zZMT5hX1OykAP61w5rhiq+pNE/vAkFdHhguHpmdF3O8+/hodYTRy0ZN1qy46Ysh/pO3OMEqaiJk2UwODaKReFBkWQ881Zhx3iB29updvbdTmUtclvU/ici99Q9NC2tw== x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR11MB5872.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230022)(346002)(39860400002)(396003)(136003)(376002)(366004)(451199015)(38070700005)(83380400001)(38100700002)(82960400001)(122000001)(66556008)(64756008)(66446008)(66476007)(8676002)(66946007)(4326008)(8936002)(76116006)(2906002)(5660300002)(52536014)(86362001)(107886003)(41300700001)(53546011)(6506007)(7696005)(966005)(33656002)(478600001)(55016003)(26005)(9686003)(186003)(54906003)(110136005)(316002)(71200400001);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?aVsGsaz5EAxm6EWuqOOVBRnbuRuCvQFpycVsQ3texLlMzLXlwsozGq+KTCdW?= =?us-ascii?Q?jbFouqV2rXObXRgftrpStuoO7BsgkFUG18dHv00llqhtPnn3uMoYCvz/LQa3?= =?us-ascii?Q?tNzSIAhf7CJpV7xj38NeO117GYU4g6/GV8dSqBOBo4tBA2pc75wOSlo2gyNt?= =?us-ascii?Q?V7IRlOs4gQ6zXQ5xJoPX70j4DuhzdWorFxz3DlhWDbZm6X22mesqM0d3Ent9?= =?us-ascii?Q?hLzPdNRaNYqa9/VwXmqYoLdRfjgKVzGDd3if3zCsf5xjK0KUkujnsxDfQaSS?= =?us-ascii?Q?aqC63OBcRG23yCU5QcEAvRU98oXpUCe4gUfdFvMCVPxM+QxEkbPlnII9F1G4?= =?us-ascii?Q?g4/UhjQDHzp5Nu2X/ZrSjIdj0xNvR+zfOksI9K6hJSfOs3HOVaa6U4kcmy2H?= =?us-ascii?Q?gMmWQfd1kiRJSpu3bwqekV83urwzWs8g2yalzliFoa8Qd9vkD4c0awwEe6e1?= =?us-ascii?Q?rftRJlAcJG9m8tn+QvvCe2RJbb6cW+/Ei5XCQo+hZvzlOtN6aYwjTyah0YGa?= =?us-ascii?Q?QxBw/OYdtpV/+KD80KHWM8Y+gWc4jbRoPSLv2VXPO4eThNJ5QrDY+qbzQFXk?= =?us-ascii?Q?oVjrjU8xHrzC8M8ztTOX30rSmfocWL/RBMyDXd3lxK6xWlhfIKUAwVPw5esa?= =?us-ascii?Q?OLRr0tCUtzwddXWicRO7Uo0Q7nmi/RAvhWPCxpqBjc96uj1Vby+KShpVtuaj?= =?us-ascii?Q?obJM+mc17ofQlIaG+3Hdv+4a8vPk6vCiZqFg2yz4Fn92KMk3Zh+0HfPGDl7s?= =?us-ascii?Q?0u2n61tRQreuin+RRbcRZa2stU5oq4eFiTaSRzmY45MAeKu9xsN1EG7sKJUB?= =?us-ascii?Q?UVpI5apo7QDpZyHtJWrn+c4iXfh3SZT5u5R5baYrHiM+tC2+kvmMyWuYsmSR?= =?us-ascii?Q?UdA7IPuYK71vUwXBcMVWo3/ech50RpPnoNMV3RFfI9Mr+zeOJRMn1Jk8y6Do?= =?us-ascii?Q?FP/OwpuKpGBOr3MNV2EebDj/AHJ5jlpms2wR8KCyGOqosxFHpX0tHSQ/ANMW?= =?us-ascii?Q?ME1hqHMpQJcRESEd1qKq6E5YfN7kfNdWH8HDqo0HiGIHujxbx3K0nGSIEvc5?= =?us-ascii?Q?yMirEeYliHbnGQBsqf2Au22uRq2X3MNHG7J16Ywh0vazdLdRusN5wSuqqMw3?= =?us-ascii?Q?s3f+H244RtfZpeuY3lir8byHGuD8DgXr/qa8rtGhistFPCPGi49atdgvLyUy?= =?us-ascii?Q?z4t5xUeG2jU2eBKPd7fG90t0ooCUZy4YRBZ7YqNDbfdnMED3Bmm6Y5M1Tez8?= =?us-ascii?Q?XiiFzF0CAvXYfEKfNQ2iTT5k8SGC64yTtr5Ex3cyElwfr72CeUHK4691z/NM?= =?us-ascii?Q?IWOqolQyPy1PWrKy27CIwpAlYgO87chOesFs4gpdw6qMwGEh3pSahB+9pIZN?= =?us-ascii?Q?yBpRlgN23jpkMAPHYomIFJJnHgXrZZ+cyhG4oxFzUq63Sm8eGpOWaiyQkmpd?= =?us-ascii?Q?vX/9oZO+umIa8vQmSMAB3tG8Y4fUDvIASgcwl7c0OE+62yI1R2RAW8K7PmTI?= =?us-ascii?Q?Hirkj3Uau3z8RLcTV9cUGh3ITD1zc4ku3TZKO+EteO1EWtAhr1eJ5wjPQFvd?= =?us-ascii?Q?FyC4MGlcFGUD2Y5k1mbLAbh3nm1BQk96gyVdAVRF?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MW4PR11MB5872.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 327eb31b-3b35-4b05-5d8c-08da9f60ba66 X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Sep 2022 01:45:01.8669 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: y4xwSAnTeeKWuYdvvtshVkFTXhXHdi+2niRGb3MKK4NZIcEDJxLR7s4HpZHdTS1DCJ03g3ow7zRbIp9RRRl5Wg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB4935 Return-Path: jiewen.yao@intel.com X-OriginatorOrg: intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Merged https://github.com/tianocore/edk2/pull/3401 > -----Original Message----- > From: Li, Yi1 > Sent: Monday, September 26, 2022 8:25 AM > To: devel@edk2.groups.io > Cc: Li, Yi1 ; Yao, Jiewen ; Wang, > Jian J ; Lu, Xiaoyu1 ; Jiang= , > Guomin ; Yao, Jiewen > Subject: [PATCH V2 1/1] CryptoPkg: Fix pem heap-buffer-overflow due to > BIO_snprintf() >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4075 >=20 > Fake BIO_snprintf() does not actually print anything to buf, > it should return -1 as error. > 0 will be considered a correct return value, the consumer may think that > the buf is valid and parse the buffer. > please refer to bugzilla link for details. >=20 > Cc: Jiewen Yao > Cc: Jian J Wang > Cc: Xiaoyu Lu > Cc: Guomin Jiang >=20 > Signed-off-by: Yi Li > reviewed-by: Jiewen Yao > --- > CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) >=20 > diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c > b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c > index c1fc33538f..b65d29485b 100644 > --- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c > +++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c > @@ -494,7 +494,9 @@ BIO_snprintf ( > ... > ) > { > - return 0; > + // Because the function does not actually print anything to buf, it re= turns > -1 as error. > + // Otherwise, the consumer may think that the buf is valid and parse t= he > buffer. > + return -1; > } >=20 > #ifdef __GNUC__ > -- > 2.31.1.windows.1