From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mx.groups.io with SMTP id smtpd.web11.11525.1582117143214267486 for ; Wed, 19 Feb 2020 04:59:03 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.151, mailfrom: liming.gao@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Feb 2020 04:59:02 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,459,1574150400"; d="scan'208";a="436223470" Received: from fmsmsx106.amr.corp.intel.com ([10.18.124.204]) by fmsmga006.fm.intel.com with ESMTP; 19 Feb 2020 04:59:02 -0800 Received: from shsmsx606.ccr.corp.intel.com (10.109.6.216) by FMSMSX106.amr.corp.intel.com (10.18.124.204) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 19 Feb 2020 04:59:02 -0800 Received: from shsmsx606.ccr.corp.intel.com (10.109.6.216) by SHSMSX606.ccr.corp.intel.com (10.109.6.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Wed, 19 Feb 2020 20:59:00 +0800 Received: from shsmsx606.ccr.corp.intel.com ([10.109.6.216]) by SHSMSX606.ccr.corp.intel.com ([10.109.6.216]) with mapi id 15.01.1713.004; Wed, 19 Feb 2020 20:59:00 +0800 From: "Liming Gao" To: "Feng, YunhuaX" , "devel@edk2.groups.io" CC: "Feng, Bob C" Subject: Re: [PATCH] Tools/FitGen: Check the input file path before open it Thread-Topic: [PATCH] Tools/FitGen: Check the input file path before open it Thread-Index: AdXnHdwLl0dFSAGLRfOFUrvSkP7G5gABnxIw Date: Wed, 19 Feb 2020 12:59:00 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-version: 11.2.0.6 dlp-product: dlpe-windows dlp-reaction: no-action x-originating-ip: [10.239.127.36] MIME-Version: 1.0 Return-Path: liming.gao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Liming Gao > -----Original Message----- > From: Feng, YunhuaX > Sent: Wednesday, February 19, 2020 8:13 PM > To: devel@edk2.groups.io > Cc: Gao, Liming ; Feng, Bob C > Subject: [PATCH] Tools/FitGen: Check the input file path before open it >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2117 >=20 > avoid path traversal attack check. >=20 > Cc: Bob Feng > Cc: Liming Gao > Signed-off-by: Yunhua Feng > --- > Silicon/Intel/Tools/FitGen/FitGen.c | 47 +++++++++++++++++++++++++++++++= ++++++ > 1 file changed, 47 insertions(+) >=20 > diff --git a/Silicon/Intel/Tools/FitGen/FitGen.c b/Silicon/Intel/Tools/Fi= tGen/FitGen.c > index 8122c10ebb..42d10d85bc 100644 > --- a/Silicon/Intel/Tools/FitGen/FitGen.c > +++ b/Silicon/Intel/Tools/FitGen/FitGen.c > @@ -401,10 +401,38 @@ SetMem ( > *(Pointer++) =3D Value; > } > return Buffer; > } >=20 > +BOOLEAN > +CheckPath ( > + IN CHAR8 * String > +) > +{ > + // > + //Return FLASE if input file path include % character or is NULL > + // > + CHAR8 *StrPtr; > + > + StrPtr =3D String; > + if (StrPtr =3D=3D NULL) { > + return FALSE; > + } > + > + if (*StrPtr =3D=3D 0) { > + return FALSE; > + } > + > + while (*StrPtr !=3D '\0') { > + if (*StrPtr =3D=3D '%') { > + return FALSE; > + } > + StrPtr++; > + } > + return TRUE; > +} > + > STATUS > ReadInputFile ( > IN CHAR8 *FileName, > OUT UINT8 **FileData, > OUT UINT32 *FileSize, > @@ -433,10 +461,19 @@ Returns: > { > FILE *FpIn; > UINT32 TempResult; >=20 > // > + //Check the File Path > + // > + if (!CheckPath(FileName)) { > + > + Error (NULL, 0, 0, "File path is invalid!", NULL); > + return STATUS_ERROR; > + } > + > + // > // Open the Input FvRecovery.fv file > // > if ((FpIn =3D fopen (FileName, "rb")) =3D=3D NULL) { > // > // Return WARNING, let caller make decision > @@ -2759,10 +2796,19 @@ Returns: > --*/ > { > FILE *FpOut; >=20 > // > + //Check the File Path > + // > + if (!CheckPath(FileName)) { > + > + Error (NULL, 0, 0, "File path is invalid!", NULL); > + return STATUS_ERROR; > + } > + > + // > // Open the output FvRecovery.fv file > // > if ((FpOut =3D fopen (FileName, "w+b")) =3D=3D NULL) { > Error (NULL, 0, 0, "Unable to open file", "%s", FileName); > return STATUS_ERROR; > @@ -2980,10 +3026,11 @@ Returns: > UINT8 *FdFileBuffer; > UINT32 FdFileSize; >=20 > UINT8 *AcmBuffer; >=20 > + FileBufferRaw =3D NULL; > // > // Step 0: Check FV or FD > // > if (((strcmp (argv[1], "-D") =3D=3D 0) || > (strcmp (argv[1], "-d") =3D=3D 0)) ) { > -- > 2.12.2.windows.2