|
 |
bdb79c |
From 288997968e9c6352b09930c23fc05f53e3bc0dad Mon Sep 17 00:00:00 2001
|
|
|
bdb79c |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
bdb79c |
Date: Fri, 22 Mar 2019 21:53:23 +0100
|
|
|
bdb79c |
Subject: [PATCH 7/8] MdeModulePkg/UdfDxe: Add boundary check for getting
|
|
|
bdb79c |
volume (free) size
|
|
|
bdb79c |
MIME-Version: 1.0
|
|
|
bdb79c |
Content-Type: text/plain; charset=UTF-8
|
|
|
bdb79c |
Content-Transfer-Encoding: 8bit
|
|
|
bdb79c |
|
|
|
bdb79c |
Message-id: <20190322205323.17693-6-lersek@redhat.com>
|
|
|
bdb79c |
Patchwork-id: 85134
|
|
|
bdb79c |
O-Subject: [RHEL-7.7 ovmf PATCH 5/5] MdeModulePkg/UdfDxe: Add boundary check for
|
|
|
bdb79c |
getting volume (free) size
|
|
|
bdb79c |
Bugzilla: 1691647
|
|
|
bdb79c |
Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
bdb79c |
Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
bdb79c |
|
|
|
bdb79c |
From: Hao Wu <hao.a.wu@intel.com>
|
|
|
bdb79c |
|
|
|
bdb79c |
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=828
|
|
|
bdb79c |
|
|
|
bdb79c |
Within GetVolumeSize():
|
|
|
bdb79c |
|
|
|
bdb79c |
The boundary check will validate the 'NumberOfPartitions' field of a
|
|
|
bdb79c |
Logical Volume Integrity Descriptor matches the data within the relating
|
|
|
bdb79c |
Logical Volume Descriptor.
|
|
|
bdb79c |
|
|
|
bdb79c |
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
|
|
|
bdb79c |
Cc: Jiewen Yao <jiewen.yao@intel.com>
|
|
|
bdb79c |
Contributed-under: TianoCore Contribution Agreement 1.1
|
|
|
bdb79c |
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
|
|
|
bdb79c |
Reviewed-by: Paulo Alcantara <palcantara@suse.de>
|
|
|
bdb79c |
Acked-by: Star Zeng <star.zeng@intel.com>
|
|
|
bdb79c |
(cherry picked from commit 3b30351b75d70ea65701ac999875fbb81a89a5ca)
|
|
|
bdb79c |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
bdb79c |
---
|
|
|
bdb79c |
.../Universal/Disk/UdfDxe/FileSystemOperations.c | 17 ++++++++++++++++-
|
|
|
bdb79c |
MdeModulePkg/Universal/Disk/UdfDxe/Udf.h | 7 +++++++
|
|
|
bdb79c |
2 files changed, 23 insertions(+), 1 deletion(-)
|
|
|
bdb79c |
|
|
|
bdb79c |
diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
|
|
|
bdb79c |
index 1aefed8..ae19a42 100644
|
|
|
bdb79c |
--- a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
|
|
|
bdb79c |
+++ b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
|
|
|
bdb79c |
@@ -2451,6 +2451,13 @@ SetFileInfo (
|
|
|
bdb79c |
/**
|
|
|
bdb79c |
Get volume and free space size information of an UDF volume.
|
|
|
bdb79c |
|
|
|
bdb79c |
+ @attention This is boundary function that may receive untrusted input.
|
|
|
bdb79c |
+ @attention The input is from FileSystem.
|
|
|
bdb79c |
+
|
|
|
bdb79c |
+ The Logical Volume Descriptor and the Logical Volume Integrity Descriptor are
|
|
|
bdb79c |
+ external inputs, so this routine will do basic validation for both descriptors
|
|
|
bdb79c |
+ and report status.
|
|
|
bdb79c |
+
|
|
|
bdb79c |
@param[in] BlockIo BlockIo interface.
|
|
|
bdb79c |
@param[in] DiskIo DiskIo interface.
|
|
|
bdb79c |
@param[in] Volume UDF volume information structure.
|
|
|
bdb79c |
@@ -2489,7 +2496,8 @@ GetVolumeSize (
|
|
|
bdb79c |
|
|
|
bdb79c |
ExtentAd = &LogicalVolDesc->IntegritySequenceExtent;
|
|
|
bdb79c |
|
|
|
bdb79c |
- if (ExtentAd->ExtentLength == 0) {
|
|
|
bdb79c |
+ if ((ExtentAd->ExtentLength == 0) ||
|
|
|
bdb79c |
+ (ExtentAd->ExtentLength < sizeof (UDF_LOGICAL_VOLUME_INTEGRITY))) {
|
|
|
bdb79c |
return EFI_VOLUME_CORRUPTED;
|
|
|
bdb79c |
}
|
|
|
bdb79c |
|
|
|
bdb79c |
@@ -2529,6 +2537,13 @@ GetVolumeSize (
|
|
|
bdb79c |
goto Out_Free;
|
|
|
bdb79c |
}
|
|
|
bdb79c |
|
|
|
bdb79c |
+ if ((LogicalVolInt->NumberOfPartitions > MAX_UINT32 / sizeof (UINT32) / 2) ||
|
|
|
bdb79c |
+ (LogicalVolInt->NumberOfPartitions * sizeof (UINT32) * 2 >
|
|
|
bdb79c |
+ ExtentAd->ExtentLength - sizeof (UDF_LOGICAL_VOLUME_INTEGRITY))) {
|
|
|
bdb79c |
+ Status = EFI_VOLUME_CORRUPTED;
|
|
|
bdb79c |
+ goto Out_Free;
|
|
|
bdb79c |
+ }
|
|
|
bdb79c |
+
|
|
|
bdb79c |
*VolumeSize = 0;
|
|
|
bdb79c |
*FreeSpaceSize = 0;
|
|
|
bdb79c |
|
|
|
bdb79c |
diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/Udf.h b/MdeModulePkg/Universal/Disk/UdfDxe/Udf.h
|
|
|
bdb79c |
index 9b82441..b054c62 100644
|
|
|
bdb79c |
--- a/MdeModulePkg/Universal/Disk/UdfDxe/Udf.h
|
|
|
bdb79c |
+++ b/MdeModulePkg/Universal/Disk/UdfDxe/Udf.h
|
|
|
bdb79c |
@@ -903,6 +903,13 @@ SetFileInfo (
|
|
|
bdb79c |
/**
|
|
|
bdb79c |
Get volume and free space size information of an UDF volume.
|
|
|
bdb79c |
|
|
|
bdb79c |
+ @attention This is boundary function that may receive untrusted input.
|
|
|
bdb79c |
+ @attention The input is from FileSystem.
|
|
|
bdb79c |
+
|
|
|
bdb79c |
+ The Logical Volume Descriptor and the Logical Volume Integrity Descriptor are
|
|
|
bdb79c |
+ external inputs, so this routine will do basic validation for both descriptors
|
|
|
bdb79c |
+ and report status.
|
|
|
bdb79c |
+
|
|
|
bdb79c |
@param[in] BlockIo BlockIo interface.
|
|
|
bdb79c |
@param[in] DiskIo DiskIo interface.
|
|
|
bdb79c |
@param[in] Volume UDF volume information structure.
|
|
|
bdb79c |
--
|
|
|
bdb79c |
1.8.3.1
|
|
|
bdb79c |
|