|
 |
b1192b |
From adfd3101494f52d71cbd8d15be9146e7570e6397 Mon Sep 17 00:00:00 2001
|
|
|
b1192b |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
b1192b |
Date: Fri, 22 Mar 2019 21:53:22 +0100
|
|
|
b1192b |
Subject: [PATCH 6/8] MdeModulePkg/UdfDxe: Add boundary check for
|
|
|
b1192b |
ComponentIdentifier decode
|
|
|
b1192b |
MIME-Version: 1.0
|
|
|
b1192b |
Content-Type: text/plain; charset=UTF-8
|
|
|
b1192b |
Content-Transfer-Encoding: 8bit
|
|
|
b1192b |
|
|
|
b1192b |
Message-id: <20190322205323.17693-5-lersek@redhat.com>
|
|
|
b1192b |
Patchwork-id: 85133
|
|
|
b1192b |
O-Subject: [RHEL-7.7 ovmf PATCH 4/5] MdeModulePkg/UdfDxe: Add boundary check for
|
|
|
b1192b |
ComponentIdentifier decode
|
|
|
b1192b |
Bugzilla: 1691647
|
|
|
b1192b |
Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
b1192b |
Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
b1192b |
|
|
|
b1192b |
From: Hao Wu <hao.a.wu@intel.com>
|
|
|
b1192b |
|
|
|
b1192b |
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=828
|
|
|
b1192b |
|
|
|
b1192b |
Within ResolveSymlink():
|
|
|
b1192b |
|
|
|
b1192b |
The boundary check will validate the 'LengthofComponentIdentifier' field
|
|
|
b1192b |
of a Path Component matches the data within the relating (Extended) File
|
|
|
b1192b |
Entry.
|
|
|
b1192b |
|
|
|
b1192b |
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
|
|
|
b1192b |
Cc: Jiewen Yao <jiewen.yao@intel.com>
|
|
|
b1192b |
Contributed-under: TianoCore Contribution Agreement 1.1
|
|
|
b1192b |
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
|
|
|
b1192b |
Reviewed-by: Paulo Alcantara <palcantara@suse.de>
|
|
|
b1192b |
Acked-by: Star Zeng <star.zeng@intel.com>
|
|
|
b1192b |
(cherry picked from commit 89f75aa04a97293a8ed9db2a90851a5053730cf5)
|
|
|
b1192b |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
b1192b |
---
|
|
|
b1192b |
MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c | 4 ++++
|
|
|
b1192b |
1 file changed, 4 insertions(+)
|
|
|
b1192b |
|
|
|
b1192b |
diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
|
|
|
b1192b |
index 0012075..1aefed8 100644
|
|
|
b1192b |
--- a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
|
|
|
b1192b |
+++ b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
|
|
|
b1192b |
@@ -2137,6 +2137,10 @@ ResolveSymlink (
|
|
|
b1192b |
return EFI_VOLUME_CORRUPTED;
|
|
|
b1192b |
}
|
|
|
b1192b |
|
|
|
b1192b |
+ if ((UINTN)PathComp->ComponentIdentifier + PathCompLength > (UINTN)EndData) {
|
|
|
b1192b |
+ return EFI_VOLUME_CORRUPTED;
|
|
|
b1192b |
+ }
|
|
|
b1192b |
+
|
|
|
b1192b |
Char = FileName;
|
|
|
b1192b |
for (Index = 1; Index < PathCompLength; Index++) {
|
|
|
b1192b |
if (CompressionId == 16) {
|
|
|
b1192b |
--
|
|
|
b1192b |
1.8.3.1
|
|
|
b1192b |
|