That is good catch. Reviewed-by: Jiewen Yao <[email protected]>
> -----Original Message----- > From: Kinney, Michael D <[email protected]> > Sent: Wednesday, October 26, 2022 12:23 AM > To: Pedro Falcato <[email protected]>; [email protected] > Cc: Vitaly Cheptsov <[email protected]>; Marvin Häuser > <[email protected]>; Gao, Liming <[email protected]>; Liu, > Zhiguang <[email protected]>; Yao, Jiewen <[email protected]> > Subject: RE: [PATCH v2 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in > SafeString > > Adding Jiewen Yao. > > Mike > > > -----Original Message----- > > From: Pedro Falcato <[email protected]> > > Sent: Monday, October 24, 2022 3:43 PM > > To: [email protected] > > Cc: Pedro Falcato <[email protected]>; Vitaly Cheptsov > <[email protected]>; Marvin Häuser <[email protected]>; > > Kinney, Michael D <[email protected]>; Gao, Liming > <[email protected]>; Liu, Zhiguang <[email protected]> > > Subject: [PATCH v2 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in > SafeString > > > > OpenCore folks established an ASAN-equipped project to fuzz Ext4Dxe, > > which was able to catch these (mostly harmless) issues. > > > > Signed-off-by: Pedro Falcato <[email protected]> > > Cc: Vitaly Cheptsov <[email protected]> > > Cc: Marvin Häuser <[email protected]> > > Cc: Michael D Kinney <[email protected]> > > Cc: Liming Gao <[email protected]> > > Cc: Zhiguang Liu <[email protected]> > > --- > > MdePkg/Library/BaseLib/SafeString.c | 24 ++++++++++++++++++++---- > > 1 file changed, 20 insertions(+), 4 deletions(-) > > > > diff --git a/MdePkg/Library/BaseLib/SafeString.c > b/MdePkg/Library/BaseLib/SafeString.c > > index f338a32a3a41..77a2585ad56d 100644 > > --- a/MdePkg/Library/BaseLib/SafeString.c > > +++ b/MdePkg/Library/BaseLib/SafeString.c > > @@ -863,6 +863,9 @@ StrHexToUintnS ( > > OUT UINTN *Data > > ) > > { > > + BOOLEAN FoundLeadingZero; > > + > > + FoundLeadingZero = FALSE; > > ASSERT (((UINTN)String & BIT0) == 0); > > > > // > > @@ -893,11 +896,12 @@ StrHexToUintnS ( > > // Ignore leading Zeros after the spaces > > // > > while (*String == L'0') { > > + FoundLeadingZero = TRUE; > > String++; > > } > > > > if (CharToUpper (*String) == L'X') { > > - if (*(String - 1) != L'0') { > > + if (!FoundLeadingZero) { > > *Data = 0; > > return RETURN_SUCCESS; > > } > > @@ -992,6 +996,9 @@ StrHexToUint64S ( > > OUT UINT64 *Data > > ) > > { > > + BOOLEAN FoundLeadingZero; > > + > > + FoundLeadingZero = FALSE; > > ASSERT (((UINTN)String & BIT0) == 0); > > > > // > > @@ -1022,11 +1029,12 @@ StrHexToUint64S ( > > // Ignore leading Zeros after the spaces > > // > > while (*String == L'0') { > > + FoundLeadingZero = TRUE; > > String++; > > } > > > > if (CharToUpper (*String) == L'X') { > > - if (*(String - 1) != L'0') { > > + if (!FoundLeadingZero) { > > *Data = 0; > > return RETURN_SUCCESS; > > } > > @@ -2393,6 +2401,9 @@ AsciiStrHexToUintnS ( > > OUT UINTN *Data > > ) > > { > > + BOOLEAN FoundLeadingZero; > > + > > + FoundLeadingZero = FALSE; > > // > > // 1. Neither String nor Data shall be a null pointer. > > // > > @@ -2421,11 +2432,12 @@ AsciiStrHexToUintnS ( > > // Ignore leading Zeros after the spaces > > // > > while (*String == '0') { > > + FoundLeadingZero = TRUE; > > String++; > > } > > > > if (AsciiCharToUpper (*String) == 'X') { > > - if (*(String - 1) != '0') { > > + if (!FoundLeadingZero) { > > *Data = 0; > > return RETURN_SUCCESS; > > } > > @@ -2517,6 +2529,9 @@ AsciiStrHexToUint64S ( > > OUT UINT64 *Data > > ) > > { > > + BOOLEAN FoundLeadingZero; > > + > > + FoundLeadingZero = FALSE; > > // > > // 1. Neither String nor Data shall be a null pointer. > > // > > @@ -2545,11 +2560,12 @@ AsciiStrHexToUint64S ( > > // Ignore leading Zeros after the spaces > > // > > while (*String == '0') { > > + FoundLeadingZero = TRUE; > > String++; > > } > > > > if (AsciiCharToUpper (*String) == 'X') { > > - if (*(String - 1) != '0') { > > + if (!FoundLeadingZero) { > > *Data = 0; > > return RETURN_SUCCESS; > > } > > -- > > 2.38.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#95608): https://edk2.groups.io/g/devel/message/95608 Mute This Topic: https://groups.io/mt/94546879/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
