public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH v2 1/1] MdePkg : UefiFileHandleLib: fix buffer overrun in FileHandleReadLine()
@ 2020-07-02  2:31 Vladimir Olovyannikov
  2020-07-03  2:30 ` [edk2-devel] " Zhiguang Liu
  0 siblings, 1 reply; 7+ messages in thread
From: Vladimir Olovyannikov @ 2020-07-02  2:31 UTC (permalink / raw)
  To: devel; +Cc: Vladimir Olovyannikov, Michael D Kinney, Liming Gao, Zhiguang Liu

If the size of the supplied buffer in FileHandleReadLine(), module
UefiFileHandleLib.c, was not 0, but was not enough to fit in
the line, the size is increased, and then the Buffer of the new
size is zeroed. This size is always larger than the supplied buffer size,
causing supplied buffer overrun. Fix the issue by using the
supplied buffer size in ZeroMem().

Signed-off-by: Vladimir Olovyannikov <vladimir.olovyannikov@broadcom.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
---
 MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c b/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c
index 28e28e5f67d5..ab34e6ccd5f4 100644
--- a/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c
+++ b/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c
@@ -969,6 +969,7 @@ FileHandleReadLine(
   UINTN       CharSize;
   UINTN       CountSoFar;
   UINTN       CrCount;
+  UINTN       OldSize;
   UINT64      OriginalFilePosition;
 
   if (Handle == NULL
@@ -1039,10 +1040,11 @@ FileHandleReadLine(
   // if we ran out of space tell when...
   //
   if ((CountSoFar+1-CrCount)*sizeof(CHAR16) > *Size){
+    OldSize = *Size;
     *Size = (CountSoFar+1-CrCount)*sizeof(CHAR16);
     if (!Truncate) {
-      if (Buffer != NULL && *Size != 0) {
-        ZeroMem(Buffer, *Size);
+      if (Buffer != NULL && OldSize != 0) {
+        ZeroMem(Buffer, OldSize);
       }
       FileHandleSetPosition(Handle, OriginalFilePosition);
       return (EFI_BUFFER_TOO_SMALL);
-- 
2.26.2.266.ge870325ee8


^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2020-08-26 16:05 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-07-02  2:31 [PATCH v2 1/1] MdePkg : UefiFileHandleLib: fix buffer overrun in FileHandleReadLine() Vladimir Olovyannikov
2020-07-03  2:30 ` [edk2-devel] " Zhiguang Liu
2020-08-24 16:18   ` Laszlo Ersek
2020-08-24 16:52     ` Laszlo Ersek
2020-08-25  4:20       ` Vladimir Olovyannikov
2020-08-26 10:03         ` Laszlo Ersek
2020-08-26 16:05           ` Vladimir Olovyannikov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox