On 06/08/21 14:12, Laszlo Ersek wrote: > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 > Repo: https://pagure.io/lersek/edk2.git > Branch: iscsi_overflow_bz3356 > > The main goal of this series is to fix a remotely exploitable buffer > overflow in the IScsiHexToBin() function. > > This posting corresponds to: > > https://bugzilla.tianocore.org/show_bug.cgi?id=3356#c22 > > meaning that it corresponds to the v2 patches attached to, and tested > in, > > https://bugzilla.tianocore.org/show_bug.cgi?id=3356#c17 > > and that it carries Phil's and Maciej's R-b's that were given up to > comment#22. > > Today is the Public Date for this embargoed security issue; I intend to > merge the patches tomorrow, based on Maciej's (already given) R-b. > (Simultaneously with this posting, I'm opening up the BZ publicly.) No > further review is required; the one day delay on the list is just to > give the community a (brief) opportunity to speak up, before the patches > are merged. > > Cc: Jiaxin Wu <jiaxin...@intel.com> > Cc: Maciej Rabeda <maciej.rab...@linux.intel.com> > Cc: Philippe Mathieu-Daudé <phi...@redhat.com> > Cc: Siyuan Fu <siyuan...@intel.com> > > Thanks, > Laszlo > > Laszlo Ersek (10): > NetworkPkg/IScsiDxe: wrap IScsiCHAP source files to 80 characters > NetworkPkg/IScsiDxe: simplify "ISCSI_CHAP_AUTH_DATA.InChallenge" size > NetworkPkg/IScsiDxe: clean up > "ISCSI_CHAP_AUTH_DATA.OutChallengeLength" > NetworkPkg/IScsiDxe: clean up library class dependencies > NetworkPkg/IScsiDxe: fix potential integer overflow in IScsiBinToHex() > NetworkPkg/IScsiDxe: assert that IScsiBinToHex() always succeeds > NetworkPkg/IScsiDxe: reformat IScsiHexToBin() leading comment block > NetworkPkg/IScsiDxe: fix IScsiHexToBin() hex parsing > NetworkPkg/IScsiDxe: fix IScsiHexToBin() buffer overflow > NetworkPkg/IScsiDxe: check IScsiHexToBin() return values > > NetworkPkg/IScsiDxe/IScsiCHAP.c | 108 +++++++++++++++----- > NetworkPkg/IScsiDxe/IScsiCHAP.h | 14 ++- > NetworkPkg/IScsiDxe/IScsiDxe.inf | 7 +- > NetworkPkg/IScsiDxe/IScsiImpl.h | 18 ++-- > NetworkPkg/IScsiDxe/IScsiMisc.c | 65 +++++++++--- > NetworkPkg/IScsiDxe/IScsiMisc.h | 19 ++-- > 6 files changed, 166 insertions(+), 65 deletions(-) >
Merged as commit range 702ba436ed8e..b8649cf2a3e6, via <https://github.com/tianocore/edk2/pull/1698>. Thanks, Laszlo -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#76287): https://edk2.groups.io/g/devel/message/76287 Mute This Topic: https://groups.io/mt/83394106/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
