Create https://github.com/tianocore/edk2/pull/3604 to merge this patch.
Thanks Liming 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Pedro Falcato 发送时间: 2022年11月5日 8:25 收件人: devel@edk2.groups.io; gaolim...@byosoft.com.cn 抄送: Vitaly Cheptsov <vit9...@protonmail.com>; Marvin Häuser <mhaeu...@posteo.de>; Michael D Kinney <michael.d.kin...@intel.com>; Zhiguang Liu <zhiguang....@intel.com>; Jiewen Yao <jiewen....@intel.com> 主题: Re: [edk2-devel] 回复: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString Hi Liming, Thank you for the review. Can we please push this in time for the stable tag? Thanks, Pedro On Fri, Nov 4, 2022 at 1:22 AM gaoliming via groups.io <http://groups.io> <gaoliming=byosoft.com...@groups.io <mailto:byosoft.com...@groups.io> > wrote: Reviewed-by: Liming Gao <gaolim...@byosoft.com.cn <mailto:gaolim...@byosoft.com.cn> > > -----邮件原件----- > 发件人: Pedro Falcato <pedro.falc...@gmail.com <mailto:pedro.falc...@gmail.com> > > 发送时间: 2022年11月3日 9:12 > 收件人: devel@edk2.groups.io <mailto:devel@edk2.groups.io> > 抄送: Pedro Falcato <pedro.falc...@gmail.com <mailto:pedro.falc...@gmail.com> > >; Vitaly Cheptsov > <vit9...@protonmail.com <mailto:vit9...@protonmail.com> >; Marvin Häuser > <mhaeu...@posteo.de <mailto:mhaeu...@posteo.de> >; > Michael D Kinney <michael.d.kin...@intel.com > <mailto:michael.d.kin...@intel.com> >; Liming Gao > <gaolim...@byosoft.com.cn <mailto:gaolim...@byosoft.com.cn> >; Zhiguang Liu > <zhiguang....@intel.com <mailto:zhiguang....@intel.com> >; Jiewen > Yao <jiewen....@intel.com <mailto:jiewen....@intel.com> > > 主题: [PATCH v3 1/1] MdePkg/BaseLib: Fix out-of-bounds reads in SafeString > > There was a OOB access in *StrHexTo* functions, when passed strings like > "XDEADBEEF". > > OpenCore folks established an ASAN-equipped project to fuzz Ext4Dxe, > which was able to catch these (mostly harmless) issues. > > Cc: Vitaly Cheptsov <vit9...@protonmail.com <mailto:vit9...@protonmail.com> > > Cc: Marvin Häuser <mhaeu...@posteo.de <mailto:mhaeu...@posteo.de> > > Cc: Michael D Kinney <michael.d.kin...@intel.com > <mailto:michael.d.kin...@intel.com> > > Cc: Liming Gao <gaolim...@byosoft.com.cn <mailto:gaolim...@byosoft.com.cn> > > Cc: Zhiguang Liu <zhiguang....@intel.com <mailto:zhiguang....@intel.com> > > Signed-off-by: Pedro Falcato <pedro.falc...@gmail.com > <mailto:pedro.falc...@gmail.com> > > Acked-by: Michael D Kinney <michael.d.kin...@intel.com > <mailto:michael.d.kin...@intel.com> > > Reviewed-by: Jiewen Yao <jiewen....@intel.com <mailto:jiewen....@intel.com> > > --- > MdePkg/Library/BaseLib/SafeString.c | 25 +++++++++++++++++++++---- > 1 file changed, 21 insertions(+), 4 deletions(-) > > diff --git a/MdePkg/Library/BaseLib/SafeString.c > b/MdePkg/Library/BaseLib/SafeString.c > index f338a32a3a41..b75b33381732 100644 > --- a/MdePkg/Library/BaseLib/SafeString.c > +++ b/MdePkg/Library/BaseLib/SafeString.c > @@ -863,6 +863,9 @@ StrHexToUintnS ( > OUT UINTN *Data > ) > { > + BOOLEAN FoundLeadingZero; > + > + FoundLeadingZero = FALSE; > ASSERT (((UINTN)String & BIT0) == 0); > > // > @@ -892,12 +895,14 @@ StrHexToUintnS ( > // > // Ignore leading Zeros after the spaces > // > + > + FoundLeadingZero = *String == L'0'; > while (*String == L'0') { > String++; > } > > if (CharToUpper (*String) == L'X') { > - if (*(String - 1) != L'0') { > + if (!FoundLeadingZero) { > *Data = 0; > return RETURN_SUCCESS; > } > @@ -992,6 +997,9 @@ StrHexToUint64S ( > OUT UINT64 *Data > ) > { > + BOOLEAN FoundLeadingZero; > + > + FoundLeadingZero = FALSE; > ASSERT (((UINTN)String & BIT0) == 0); > > // > @@ -1021,12 +1029,13 @@ StrHexToUint64S ( > // > // Ignore leading Zeros after the spaces > // > + FoundLeadingZero = *String == L'0'; > while (*String == L'0') { > String++; > } > > if (CharToUpper (*String) == L'X') { > - if (*(String - 1) != L'0') { > + if (!FoundLeadingZero) { > *Data = 0; > return RETURN_SUCCESS; > } > @@ -2393,6 +2402,9 @@ AsciiStrHexToUintnS ( > OUT UINTN *Data > ) > { > + BOOLEAN FoundLeadingZero; > + > + FoundLeadingZero = FALSE; > // > // 1. Neither String nor Data shall be a null pointer. > // > @@ -2420,12 +2432,13 @@ AsciiStrHexToUintnS ( > // > // Ignore leading Zeros after the spaces > // > + FoundLeadingZero = *String == '0'; > while (*String == '0') { > String++; > } > > if (AsciiCharToUpper (*String) == 'X') { > - if (*(String - 1) != '0') { > + if (!FoundLeadingZero) { > *Data = 0; > return RETURN_SUCCESS; > } > @@ -2517,6 +2530,9 @@ AsciiStrHexToUint64S ( > OUT UINT64 *Data > ) > { > + BOOLEAN FoundLeadingZero; > + > + FoundLeadingZero = FALSE; > // > // 1. Neither String nor Data shall be a null pointer. > // > @@ -2544,12 +2560,13 @@ AsciiStrHexToUint64S ( > // > // Ignore leading Zeros after the spaces > // > + FoundLeadingZero = *String == '0'; > while (*String == '0') { > String++; > } > > if (AsciiCharToUpper (*String) == 'X') { > - if (*(String - 1) != '0') { > + if (!FoundLeadingZero) { > *Data = 0; > return RETURN_SUCCESS; > } > -- > 2.38.1 -- Pedro Falcato -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#96016): https://edk2.groups.io/g/devel/message/96016 Mute This Topic: https://groups.io/mt/94857316/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
