|
 |
12bdf0 |
From 0dac937f2845a1bc4943a0cfed3392d35afba733 Mon Sep 17 00:00:00 2001
|
|
|
12bdf0 |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
Date: Tue, 8 Jun 2021 14:12:51 +0200
|
|
|
12bdf0 |
Subject: [PATCH 02/10] NetworkPkg/IScsiDxe: simplify
|
|
|
12bdf0 |
"ISCSI_CHAP_AUTH_DATA.InChallenge" size
|
|
|
12bdf0 |
MIME-Version: 1.0
|
|
|
12bdf0 |
Content-Type: text/plain; charset=UTF-8
|
|
|
12bdf0 |
Content-Transfer-Encoding: 8bit
|
|
|
12bdf0 |
|
|
|
12bdf0 |
RH-Author: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
RH-MergeRequest: 5: NetworkPkg/IScsiDxe: fix IScsiHexToBin() security and functionality bugs [rhel-8.5.0, post-rebase]
|
|
|
12bdf0 |
RH-Commit: [2/10] 8b57211651e13185a636daa5369993054bd7334b
|
|
|
12bdf0 |
RH-Bugzilla: 1956408
|
|
|
12bdf0 |
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
12bdf0 |
|
|
|
12bdf0 |
The ISCSI_CHAP_AUTH_MAX_LEN macro is defined with value 1024.
|
|
|
12bdf0 |
|
|
|
12bdf0 |
The usage of this macro currently involves a semantic (not functional)
|
|
|
12bdf0 |
bug, which we're going to fix in a subsequent patch, eliminating
|
|
|
12bdf0 |
ISCSI_CHAP_AUTH_MAX_LEN altogether.
|
|
|
12bdf0 |
|
|
|
12bdf0 |
For now, remove the macro's usage from all
|
|
|
12bdf0 |
"ISCSI_CHAP_AUTH_DATA.InChallenge" contexts. This is doable without
|
|
|
12bdf0 |
duplicating open-coded constants.
|
|
|
12bdf0 |
|
|
|
12bdf0 |
No changes in functionality.
|
|
|
12bdf0 |
|
|
|
12bdf0 |
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
|
|
|
12bdf0 |
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
|
|
|
12bdf0 |
Cc: Philippe Mathieu-Daud <philmd@redhat.com>
|
|
|
12bdf0 |
Cc: Siyuan Fu <siyuan.fu@intel.com>
|
|
|
12bdf0 |
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356
|
|
|
12bdf0 |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
Reviewed-by: Philippe Mathieu-Daud <philmd@redhat.com>
|
|
|
12bdf0 |
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
|
|
|
12bdf0 |
Message-Id: <20210608121259.32451-3-lersek@redhat.com>
|
|
|
12bdf0 |
(cherry picked from commit 29cab43bb7912a12efa5a78dac15394aee866e4c)
|
|
|
12bdf0 |
---
|
|
|
12bdf0 |
NetworkPkg/IScsiDxe/IScsiCHAP.c | 2 +-
|
|
|
12bdf0 |
NetworkPkg/IScsiDxe/IScsiCHAP.h | 2 +-
|
|
|
12bdf0 |
2 files changed, 2 insertions(+), 2 deletions(-)
|
|
|
12bdf0 |
|
|
|
12bdf0 |
diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
index cbbc56ae5b..df3c2eb120 100644
|
|
|
12bdf0 |
--- a/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
@@ -289,7 +289,7 @@ IScsiCHAPOnRspReceived (
|
|
|
12bdf0 |
}
|
|
|
12bdf0 |
|
|
|
12bdf0 |
AuthData->InIdentifier = (UINT32) Result;
|
|
|
12bdf0 |
- AuthData->InChallengeLength = ISCSI_CHAP_AUTH_MAX_LEN;
|
|
|
12bdf0 |
+ AuthData->InChallengeLength = (UINT32) sizeof (AuthData->InChallenge);
|
|
|
12bdf0 |
IScsiHexToBin (
|
|
|
12bdf0 |
(UINT8 *) AuthData->InChallenge,
|
|
|
12bdf0 |
&AuthData->InChallengeLength,
|
|
|
12bdf0 |
diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.h b/NetworkPkg/IScsiDxe/IScsiCHAP.h
|
|
|
12bdf0 |
index 5e59fb678b..1fc1d96ea3 100644
|
|
|
12bdf0 |
--- a/NetworkPkg/IScsiDxe/IScsiCHAP.h
|
|
|
12bdf0 |
+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.h
|
|
|
12bdf0 |
@@ -49,7 +49,7 @@ typedef struct _ISCSI_CHAP_AUTH_CONFIG_NVDATA {
|
|
|
12bdf0 |
typedef struct _ISCSI_CHAP_AUTH_DATA {
|
|
|
12bdf0 |
ISCSI_CHAP_AUTH_CONFIG_NVDATA *AuthConfig;
|
|
|
12bdf0 |
UINT32 InIdentifier;
|
|
|
12bdf0 |
- UINT8 InChallenge[ISCSI_CHAP_AUTH_MAX_LEN];
|
|
|
12bdf0 |
+ UINT8 InChallenge[1024];
|
|
|
12bdf0 |
UINT32 InChallengeLength;
|
|
|
12bdf0 |
//
|
|
|
12bdf0 |
// Calculated CHAP Response (CHAP_R) value.
|
|
|
12bdf0 |
--
|
|
|
12bdf0 |
2.27.0
|
|
|
12bdf0 |
|