|
 |
1dc609 |
From 697cb1880b624f83bc9e926c3614d070eb365f06 Mon Sep 17 00:00:00 2001
|
|
|
1dc609 |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
1dc609 |
Date: Mon, 2 Dec 2019 12:31:47 +0100
|
|
|
1dc609 |
Subject: [PATCH 3/9] CryptoPkg/Crt: turn strchr() into a function
|
|
|
1dc609 |
(CVE-2019-14553)
|
|
|
1dc609 |
MIME-Version: 1.0
|
|
|
1dc609 |
Content-Type: text/plain; charset=UTF-8
|
|
|
1dc609 |
Content-Transfer-Encoding: 8bit
|
|
|
1dc609 |
|
|
|
1dc609 |
RH-Author: Laszlo Ersek <lersek@redhat.com>
|
|
|
1dc609 |
Message-id: <20191117220052.15700-4-lersek@redhat.com>
|
|
|
1dc609 |
Patchwork-id: 92458
|
|
|
1dc609 |
O-Subject: [RHEL-8.2.0 edk2 PATCH 3/9] CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553)
|
|
|
1dc609 |
Bugzilla: 1536624
|
|
|
1dc609 |
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
1dc609 |
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
1dc609 |
|
|
|
1dc609 |
According to the ISO C standard, strchr() is a function. We #define it as
|
|
|
1dc609 |
a macro. Unfortunately, our macro evaluates the first argument ("str")
|
|
|
1dc609 |
twice. If the expression passed for "str" has side effects, the behavior
|
|
|
1dc609 |
may be undefined.
|
|
|
1dc609 |
|
|
|
1dc609 |
In a later patch in this series, we're going to resurrect "inet_pton.c"
|
|
|
1dc609 |
(originally from the StdLib package), which calls strchr() just like that:
|
|
|
1dc609 |
|
|
|
1dc609 |
strchr((xdigits = xdigits_l), ch)
|
|
|
1dc609 |
strchr((xdigits = xdigits_u), ch)
|
|
|
1dc609 |
|
|
|
1dc609 |
To enable this kind of function call, turn strchr() into a function.
|
|
|
1dc609 |
|
|
|
1dc609 |
Cc: David Woodhouse <dwmw2@infradead.org>
|
|
|
1dc609 |
Cc: Jian J Wang <jian.j.wang@intel.com>
|
|
|
1dc609 |
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
|
|
|
1dc609 |
Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
|
|
|
1dc609 |
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
|
|
|
1dc609 |
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960
|
|
|
1dc609 |
CVE: CVE-2019-14553
|
|
|
1dc609 |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
1dc609 |
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
|
|
|
1dc609 |
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
|
|
|
1dc609 |
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
|
|
|
1dc609 |
(cherry picked from commit eb520d94dba7369d1886cd5522d5a2c36fb02209)
|
|
|
1dc609 |
---
|
|
|
1dc609 |
CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c | 5 +++++
|
|
|
1dc609 |
CryptoPkg/Library/Include/CrtLibSupport.h | 2 +-
|
|
|
1dc609 |
2 files changed, 6 insertions(+), 1 deletion(-)
|
|
|
1dc609 |
|
|
|
1dc609 |
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
|
|
|
1dc609 |
index 71a2ef3..42235ab 100644
|
|
|
1dc609 |
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
|
|
|
1dc609 |
+++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
|
|
|
1dc609 |
@@ -115,6 +115,11 @@ QuickSortWorker (
|
|
|
1dc609 |
// -- String Manipulation Routines --
|
|
|
1dc609 |
//
|
|
|
1dc609 |
|
|
|
1dc609 |
+char *strchr(const char *str, int ch)
|
|
|
1dc609 |
+{
|
|
|
1dc609 |
+ return ScanMem8 (str, AsciiStrSize (str), (UINT8)ch);
|
|
|
1dc609 |
+}
|
|
|
1dc609 |
+
|
|
|
1dc609 |
/* Scan a string for the last occurrence of a character */
|
|
|
1dc609 |
char *strrchr (const char *str, int c)
|
|
|
1dc609 |
{
|
|
|
1dc609 |
diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
|
|
|
1dc609 |
index 5806f50..b90da20 100644
|
|
|
1dc609 |
--- a/CryptoPkg/Library/Include/CrtLibSupport.h
|
|
|
1dc609 |
+++ b/CryptoPkg/Library/Include/CrtLibSupport.h
|
|
|
1dc609 |
@@ -147,6 +147,7 @@ int isupper (int);
|
|
|
1dc609 |
int tolower (int);
|
|
|
1dc609 |
int strcmp (const char *, const char *);
|
|
|
1dc609 |
int strncasecmp (const char *, const char *, size_t);
|
|
|
1dc609 |
+char *strchr (const char *, int);
|
|
|
1dc609 |
char *strrchr (const char *, int);
|
|
|
1dc609 |
unsigned long strtoul (const char *, char **, int);
|
|
|
1dc609 |
long strtol (const char *, char **, int);
|
|
|
1dc609 |
@@ -188,7 +189,6 @@ void abort (void);
|
|
|
1dc609 |
#define strcpy(strDest,strSource) AsciiStrCpyS(strDest,MAX_STRING_SIZE,strSource)
|
|
|
1dc609 |
#define strncpy(strDest,strSource,count) AsciiStrnCpyS(strDest,MAX_STRING_SIZE,strSource,(UINTN)count)
|
|
|
1dc609 |
#define strcat(strDest,strSource) AsciiStrCatS(strDest,MAX_STRING_SIZE,strSource)
|
|
|
1dc609 |
-#define strchr(str,ch) ScanMem8((VOID *)(str),AsciiStrSize(str),(UINT8)ch)
|
|
|
1dc609 |
#define strncmp(string1,string2,count) (int)(AsciiStrnCmp(string1,string2,(UINTN)(count)))
|
|
|
1dc609 |
#define strcasecmp(str1,str2) (int)AsciiStriCmp(str1,str2)
|
|
|
1dc609 |
#define sprintf(buf,...) AsciiSPrint(buf,MAX_STRING_SIZE,__VA_ARGS__)
|
|
|
1dc609 |
--
|
|
|
1dc609 |
1.8.3.1
|
|
|
1dc609 |
|