render / rpms / edk2

Forked from rpms/edk2 3 months ago
Clone

Blame SOURCES/edk2-MdeModulePkg-PiDxeS3BootScriptLib-Fix-potential-nume.patch

63d87e
From 51d2956d480fef83f765013c8aec7f7ddc14b84d Mon Sep 17 00:00:00 2001
63d87e
From: Laszlo Ersek <lersek@redhat.com>
63d87e
Date: Tue, 11 Feb 2020 17:02:00 +0100
63d87e
Subject: [PATCH 2/2] MdeModulePkg/PiDxeS3BootScriptLib: Fix potential numeric
63d87e
 truncation (CVE-2019-14563)
63d87e
MIME-Version: 1.0
63d87e
Content-Type: text/plain; charset=UTF-8
63d87e
Content-Transfer-Encoding: 8bit
63d87e
63d87e
RH-Author: Laszlo Ersek <lersek@redhat.com>
63d87e
Message-id: <20200211170200.12389-3-lersek@redhat.com>
63d87e
Patchwork-id: 93777
63d87e
O-Subject: [RHEL-8.2.0 edk2 PATCH 2/2] MdeModulePkg/PiDxeS3BootScriptLib: Fix potential numeric truncation (CVE-2019-14563)
63d87e
Bugzilla: 1801274
63d87e
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
63d87e
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
63d87e
63d87e
From: Hao A Wu <hao.a.wu@intel.com>
63d87e
63d87e
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2001
63d87e
63d87e
For S3BootScriptLib APIs:
63d87e
63d87e
S3BootScriptSaveIoWrite
63d87e
S3BootScriptSaveMemWrite
63d87e
S3BootScriptSavePciCfgWrite
63d87e
S3BootScriptSavePciCfg2Write
63d87e
S3BootScriptSaveSmbusExecute
63d87e
S3BootScriptSaveInformation
63d87e
S3BootScriptSaveInformationAsciiString
63d87e
S3BootScriptLabel (happen in S3BootScriptLabelInternal())
63d87e
63d87e
possible numeric truncations will happen that may lead to S3 boot script
63d87e
entry with improper size being returned to store the boot script data.
63d87e
This commit will add checks to prevent this kind of issue.
63d87e
63d87e
Please note that the remaining S3BootScriptLib APIs:
63d87e
63d87e
S3BootScriptSaveIoReadWrite
63d87e
S3BootScriptSaveMemReadWrite
63d87e
S3BootScriptSavePciCfgReadWrite
63d87e
S3BootScriptSavePciCfg2ReadWrite
63d87e
S3BootScriptSaveStall
63d87e
S3BootScriptSaveDispatch2
63d87e
S3BootScriptSaveDispatch
63d87e
S3BootScriptSaveMemPoll
63d87e
S3BootScriptSaveIoPoll
63d87e
S3BootScriptSavePciPoll
63d87e
S3BootScriptSavePci2Poll
63d87e
S3BootScriptCloseTable
63d87e
S3BootScriptExecute
63d87e
S3BootScriptMoveLastOpcode
63d87e
S3BootScriptCompare
63d87e
63d87e
are not affected by such numeric truncation.
63d87e
63d87e
Signed-off-by: Hao A Wu <hao.a.wu@intel.com>
63d87e
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
63d87e
Reviewed-by: Eric Dong <eric.dong@intel.com>
63d87e
Acked-by: Jian J Wang <jian.j.wang@intel.com>
63d87e
(cherry picked from commit 322ac05f8bbc1bce066af1dabd1b70ccdbe28891)
63d87e
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
63d87e
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
63d87e
---
63d87e
 .../Library/PiDxeS3BootScriptLib/BootScriptSave.c  | 52 +++++++++++++++++++++-
63d87e
 1 file changed, 51 insertions(+), 1 deletion(-)
63d87e
63d87e
diff --git a/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c b/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
63d87e
index 9106e7d..9315fc9 100644
63d87e
--- a/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
63d87e
+++ b/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
63d87e
@@ -1,7 +1,7 @@
63d87e
 /** @file
63d87e
   Save the S3 data to S3 boot script.
63d87e
 
63d87e
-  Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.
63d87e
+  Copyright (c) 2006 - 2020, Intel Corporation. All rights reserved.
63d87e
 
63d87e
   SPDX-License-Identifier: BSD-2-Clause-Patent
63d87e
 
63d87e
@@ -1006,6 +1006,14 @@ S3BootScriptSaveIoWrite (
63d87e
   EFI_BOOT_SCRIPT_IO_WRITE  ScriptIoWrite;
63d87e
 
63d87e
   WidthInByte = (UINT8) (0x01 << (Width & 0x03));
63d87e
+
63d87e
+  //
63d87e
+  // Truncation check
63d87e
+  //
63d87e
+  if ((Count > MAX_UINT8) ||
63d87e
+      (WidthInByte * Count > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_IO_WRITE))) {
63d87e
+    return RETURN_OUT_OF_RESOURCES;
63d87e
+  }
63d87e
   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_IO_WRITE) + (WidthInByte * Count));
63d87e
 
63d87e
   Script = S3BootScriptGetEntryAddAddress (Length);
63d87e
@@ -1102,6 +1110,14 @@ S3BootScriptSaveMemWrite (
63d87e
   EFI_BOOT_SCRIPT_MEM_WRITE  ScriptMemWrite;
63d87e
 
63d87e
   WidthInByte = (UINT8) (0x01 << (Width & 0x03));
63d87e
+
63d87e
+  //
63d87e
+  // Truncation check
63d87e
+  //
63d87e
+  if ((Count > MAX_UINT8) ||
63d87e
+      (WidthInByte * Count > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_MEM_WRITE))) {
63d87e
+    return RETURN_OUT_OF_RESOURCES;
63d87e
+  }
63d87e
   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_MEM_WRITE) + (WidthInByte * Count));
63d87e
 
63d87e
   Script = S3BootScriptGetEntryAddAddress (Length);
63d87e
@@ -1206,6 +1222,14 @@ S3BootScriptSavePciCfgWrite (
63d87e
   }
63d87e
 
63d87e
   WidthInByte = (UINT8) (0x01 << (Width & 0x03));
63d87e
+
63d87e
+  //
63d87e
+  // Truncation check
63d87e
+  //
63d87e
+  if ((Count > MAX_UINT8) ||
63d87e
+      (WidthInByte * Count > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_PCI_CONFIG_WRITE))) {
63d87e
+    return RETURN_OUT_OF_RESOURCES;
63d87e
+  }
63d87e
   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_PCI_CONFIG_WRITE) + (WidthInByte * Count));
63d87e
 
63d87e
   Script = S3BootScriptGetEntryAddAddress (Length);
63d87e
@@ -1324,6 +1348,14 @@ S3BootScriptSavePciCfg2Write (
63d87e
   }
63d87e
 
63d87e
   WidthInByte = (UINT8) (0x01 << (Width & 0x03));
63d87e
+
63d87e
+  //
63d87e
+  // Truncation check
63d87e
+  //
63d87e
+  if ((Count > MAX_UINT8) ||
63d87e
+      (WidthInByte * Count > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_PCI_CONFIG2_WRITE))) {
63d87e
+    return RETURN_OUT_OF_RESOURCES;
63d87e
+  }
63d87e
   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_PCI_CONFIG2_WRITE) + (WidthInByte * Count));
63d87e
 
63d87e
   Script = S3BootScriptGetEntryAddAddress (Length);
63d87e
@@ -1549,6 +1581,12 @@ S3BootScriptSaveSmbusExecute (
63d87e
     return Status;
63d87e
   }
63d87e
 
63d87e
+  //
63d87e
+  // Truncation check
63d87e
+  //
63d87e
+  if (BufferLength > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_SMBUS_EXECUTE)) {
63d87e
+    return RETURN_OUT_OF_RESOURCES;
63d87e
+  }
63d87e
   DataSize = (UINT8)(sizeof (EFI_BOOT_SCRIPT_SMBUS_EXECUTE) + BufferLength);
63d87e
 
63d87e
   Script = S3BootScriptGetEntryAddAddress (DataSize);
63d87e
@@ -1736,6 +1774,12 @@ S3BootScriptSaveInformation (
63d87e
   UINT8                 *Script;
63d87e
   EFI_BOOT_SCRIPT_INFORMATION  ScriptInformation;
63d87e
 
63d87e
+  //
63d87e
+  // Truncation check
63d87e
+  //
63d87e
+  if (InformationLength > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_INFORMATION)) {
63d87e
+    return RETURN_OUT_OF_RESOURCES;
63d87e
+  }
63d87e
   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_INFORMATION) + InformationLength);
63d87e
 
63d87e
   Script = S3BootScriptGetEntryAddAddress (Length);
63d87e
@@ -2195,6 +2239,12 @@ S3BootScriptLabelInternal (
63d87e
   UINT8                 *Script;
63d87e
   EFI_BOOT_SCRIPT_INFORMATION  ScriptInformation;
63d87e
 
63d87e
+  //
63d87e
+  // Truncation check
63d87e
+  //
63d87e
+  if (InformationLength > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_INFORMATION)) {
63d87e
+    return RETURN_OUT_OF_RESOURCES;
63d87e
+  }
63d87e
   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_INFORMATION) + InformationLength);
63d87e
 
63d87e
   Script = S3BootScriptGetEntryAddAddress (Length);
63d87e
-- 
63d87e
1.8.3.1
63d87e