Reviewed-by: Liming Gao <liming....@intel.com> > -----Original Message----- > From: Feng, YunhuaX <yunhuax.f...@intel.com> > Sent: Wednesday, February 19, 2020 8:13 PM > To: devel@edk2.groups.io > Cc: Gao, Liming <liming....@intel.com>; Feng, Bob C <bob.c.f...@intel.com> > Subject: [PATCH] Tools/FitGen: Check the input file path before open it > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2117 > > avoid path traversal attack check. > > Cc: Bob Feng <bob.c.f...@intel.com> > Cc: Liming Gao <liming....@intel.com> > Signed-off-by: Yunhua Feng <yunhuax.f...@intel.com> > --- > Silicon/Intel/Tools/FitGen/FitGen.c | 47 > +++++++++++++++++++++++++++++++++++++ > 1 file changed, 47 insertions(+) > > diff --git a/Silicon/Intel/Tools/FitGen/FitGen.c > b/Silicon/Intel/Tools/FitGen/FitGen.c > index 8122c10ebb..42d10d85bc 100644 > --- a/Silicon/Intel/Tools/FitGen/FitGen.c > +++ b/Silicon/Intel/Tools/FitGen/FitGen.c > @@ -401,10 +401,38 @@ SetMem ( > *(Pointer++) = Value; > } > return Buffer; > } > > +BOOLEAN > +CheckPath ( > + IN CHAR8 * String > +) > +{ > + // > + //Return FLASE if input file path include % character or is NULL > + // > + CHAR8 *StrPtr; > + > + StrPtr = String; > + if (StrPtr == NULL) { > + return FALSE; > + } > + > + if (*StrPtr == 0) { > + return FALSE; > + } > + > + while (*StrPtr != '\0') { > + if (*StrPtr == '%') { > + return FALSE; > + } > + StrPtr++; > + } > + return TRUE; > +} > + > STATUS > ReadInputFile ( > IN CHAR8 *FileName, > OUT UINT8 **FileData, > OUT UINT32 *FileSize, > @@ -433,10 +461,19 @@ Returns: > { > FILE *FpIn; > UINT32 TempResult; > > // > + //Check the File Path > + // > + if (!CheckPath(FileName)) { > + > + Error (NULL, 0, 0, "File path is invalid!", NULL); > + return STATUS_ERROR; > + } > + > + // > // Open the Input FvRecovery.fv file > // > if ((FpIn = fopen (FileName, "rb")) == NULL) { > // > // Return WARNING, let caller make decision > @@ -2759,10 +2796,19 @@ Returns: > --*/ > { > FILE *FpOut; > > // > + //Check the File Path > + // > + if (!CheckPath(FileName)) { > + > + Error (NULL, 0, 0, "File path is invalid!", NULL); > + return STATUS_ERROR; > + } > + > + // > // Open the output FvRecovery.fv file > // > if ((FpOut = fopen (FileName, "w+b")) == NULL) { > Error (NULL, 0, 0, "Unable to open file", "%s", FileName); > return STATUS_ERROR; > @@ -2980,10 +3026,11 @@ Returns: > UINT8 *FdFileBuffer; > UINT32 FdFileSize; > > UINT8 *AcmBuffer; > > + FileBufferRaw = NULL; > // > // Step 0: Check FV or FD > // > if (((strcmp (argv[1], "-D") == 0) || > (strcmp (argv[1], "-d") == 0)) ) { > -- > 2.12.2.windows.2
-=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#54637): https://edk2.groups.io/g/devel/message/54637 Mute This Topic: https://groups.io/mt/71394296/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
