tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/DxeCapsuleLibFmp: Use BmpSupportLib 

https://bugzilla.tianocore.org/show_bug.cgi?id=800

Based on content from the following branch/commits:
https://github.com/Microsoft/MS_UEFI/tree/share/MsCapsuleSupport
33bab4031a
ca516b1a61
2b9f111f2e

Use BmpSupportLib to convert a BMP graphics image to a
GOP BLT buffer.

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Bret Barkelew <Bret.Barkelew@microsoft.com>
This commit is contained in:
Michael D Kinney 2017-12-27 16:09:31 -08:00
parent 4123d6da70
commit 1ec2e7d0e8
4 changed files with 12 additions and 264 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

268
MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleLib.c
View File

@ -7,10 +7,10 @@
buffer overflow, integer overflow. buffer overflow, integer overflow.
SupportCapsuleImage(), ProcessCapsuleImage(), IsValidCapsuleHeader(), SupportCapsuleImage(), ProcessCapsuleImage(), IsValidCapsuleHeader(),
ValidateFmpCapsule(), DisplayCapsuleImage(), ConvertBmpToGopBlt() will ValidateFmpCapsule(), and DisplayCapsuleImage() receives untrusted input and
receive untrusted input and do basic validation. performs basic validation.
Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR> Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -23,7 +23,6 @@
#include <PiDxe.h> #include <PiDxe.h>
#include <IndustryStandard/Bmp.h>
#include <IndustryStandard/WindowsUxCapsule.h> #include <IndustryStandard/WindowsUxCapsule.h>
#include <Guid/FmpCapsule.h> #include <Guid/FmpCapsule.h>
@ -41,6 +40,7 @@
#include <Library/DevicePathLib.h> #include <Library/DevicePathLib.h>
#include <Library/UefiLib.h> #include <Library/UefiLib.h>
#include <Library/PcdLib.h> #include <Library/PcdLib.h>
#include <Library/BmpSupportLib.h>
#include <Protocol/GraphicsOutput.h> #include <Protocol/GraphicsOutput.h>
#include <Protocol/EsrtManagement.h> #include <Protocol/EsrtManagement.h>
@ -306,262 +306,6 @@ ValidateFmpCapsule (
return EFI_SUCCESS; return EFI_SUCCESS;
} }
/**
Convert a *.BMP graphics image to a GOP blt buffer. If a NULL Blt buffer
is passed in a GopBlt buffer will be allocated by this routine. If a GopBlt
buffer is passed in it will be used if it is big enough.
Caution: This function may receive untrusted input.
@param[in] BmpImage Pointer to BMP file
@param[in] BmpImageSize Number of bytes in BmpImage
@param[in, out] GopBlt Buffer containing GOP version of BmpImage.
@param[in, out] GopBltSize Size of GopBlt in bytes.
@param[out] PixelHeight Height of GopBlt/BmpImage in pixels
@param[out] PixelWidth Width of GopBlt/BmpImage in pixels
@retval EFI_SUCCESS GopBlt and GopBltSize are returned.
@retval EFI_UNSUPPORTED BmpImage is not a valid *.BMP image
@retval EFI_BUFFER_TOO_SMALL The passed in GopBlt buffer is not big enough.
GopBltSize will contain the required size.
@retval EFI_OUT_OF_RESOURCES No enough buffer to allocate.
**/
STATIC
EFI_STATUS
ConvertBmpToGopBlt (
IN VOID *BmpImage,
IN UINTN BmpImageSize,
IN OUT VOID **GopBlt,
IN OUT UINTN *GopBltSize,
OUT UINTN *PixelHeight,
OUT UINTN *PixelWidth
)
{
UINT8 *Image;
UINT8 *ImageHeader;
BMP_IMAGE_HEADER *BmpHeader;
BMP_COLOR_MAP *BmpColorMap;
EFI_GRAPHICS_OUTPUT_BLT_PIXEL *BltBuffer;
EFI_GRAPHICS_OUTPUT_BLT_PIXEL *Blt;
UINT64 BltBufferSize;
UINTN Index;
UINTN Height;
UINTN Width;
UINTN ImageIndex;
UINT32 DataSizePerLine;
BOOLEAN IsAllocated;
UINT32 ColorMapNum;
if (sizeof (BMP_IMAGE_HEADER) > BmpImageSize) {
return EFI_INVALID_PARAMETER;
}
BmpHeader = (BMP_IMAGE_HEADER *) BmpImage;
if (BmpHeader->CharB != 'B' || BmpHeader->CharM != 'M') {
return EFI_UNSUPPORTED;
}
//
// Doesn't support compress.
//
if (BmpHeader->CompressionType != 0) {
return EFI_UNSUPPORTED;
}
//
// Only support BITMAPINFOHEADER format.
// BITMAPFILEHEADER + BITMAPINFOHEADER = BMP_IMAGE_HEADER
//
if (BmpHeader->HeaderSize != sizeof (BMP_IMAGE_HEADER) - OFFSET_OF(BMP_IMAGE_HEADER, HeaderSize)) {
return EFI_UNSUPPORTED;
}
//
// The data size in each line must be 4 byte alignment.
//
DataSizePerLine = ((BmpHeader->PixelWidth * BmpHeader->BitPerPixel + 31) >> 3) & (~0x3);
BltBufferSize = MultU64x32 (DataSizePerLine, BmpHeader->PixelHeight);
if (BltBufferSize > (UINT32) ~0) {
return EFI_INVALID_PARAMETER;
}
if ((BmpHeader->Size != BmpImageSize) ||
(BmpHeader->Size < BmpHeader->ImageOffset) ||
(BmpHeader->Size - BmpHeader->ImageOffset != BmpHeader->PixelHeight * DataSizePerLine)) {
return EFI_INVALID_PARAMETER;
}
//
// Calculate Color Map offset in the image.
//
Image = BmpImage;
BmpColorMap = (BMP_COLOR_MAP *) (Image + sizeof (BMP_IMAGE_HEADER));
if (BmpHeader->ImageOffset < sizeof (BMP_IMAGE_HEADER)) {
return EFI_INVALID_PARAMETER;
}
if (BmpHeader->ImageOffset > sizeof (BMP_IMAGE_HEADER)) {
switch (BmpHeader->BitPerPixel) {
case 1:
ColorMapNum = 2;
break;
case 4:
ColorMapNum = 16;
break;
case 8:
ColorMapNum = 256;
break;
default:
ColorMapNum = 0;
break;
}
//
// BMP file may has padding data between the bmp header section and the bmp data section.
//
if (BmpHeader->ImageOffset - sizeof (BMP_IMAGE_HEADER) < sizeof (BMP_COLOR_MAP) * ColorMapNum) {
return EFI_INVALID_PARAMETER;
}
}
//
// Calculate graphics image data address in the image
//
Image = ((UINT8 *) BmpImage) + BmpHeader->ImageOffset;
ImageHeader = Image;
//
// Calculate the BltBuffer needed size.
//
BltBufferSize = MultU64x32 ((UINT64) BmpHeader->PixelWidth, BmpHeader->PixelHeight);
//
// Ensure the BltBufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) doesn't overflow
//
if (BltBufferSize > DivU64x32 ((UINTN) ~0, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL))) {
return EFI_UNSUPPORTED;
}
BltBufferSize = MultU64x32 (BltBufferSize, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL));
IsAllocated = FALSE;
if (*GopBlt == NULL) {
//
// GopBlt is not allocated by caller.
//
*GopBltSize = (UINTN) BltBufferSize;
*GopBlt = AllocatePool (*GopBltSize);
IsAllocated = TRUE;
if (*GopBlt == NULL) {
return EFI_OUT_OF_RESOURCES;
}
} else {
//
// GopBlt has been allocated by caller.
//
if (*GopBltSize < (UINTN) BltBufferSize) {
*GopBltSize = (UINTN) BltBufferSize;
return EFI_BUFFER_TOO_SMALL;
}
}
*PixelWidth = BmpHeader->PixelWidth;
*PixelHeight = BmpHeader->PixelHeight;
//
// Convert image from BMP to Blt buffer format
//
BltBuffer = *GopBlt;
for (Height = 0; Height < BmpHeader->PixelHeight; Height++) {
Blt = &BltBuffer[(BmpHeader->PixelHeight - Height - 1) * BmpHeader->PixelWidth];
for (Width = 0; Width < BmpHeader->PixelWidth; Width++, Image++, Blt++) {
switch (BmpHeader->BitPerPixel) {
case 1:
//
// Convert 1-bit (2 colors) BMP to 24-bit color
//
for (Index = 0; Index < 8 && Width < BmpHeader->PixelWidth; Index++) {
Blt->Red = BmpColorMap[((*Image) >> (7 - Index)) & 0x1].Red;
Blt->Green = BmpColorMap[((*Image) >> (7 - Index)) & 0x1].Green;
Blt->Blue = BmpColorMap[((*Image) >> (7 - Index)) & 0x1].Blue;
Blt++;
Width++;
}
Blt--;
Width--;
break;
case 4:
//
// Convert 4-bit (16 colors) BMP Palette to 24-bit color
//
Index = (*Image) >> 4;
Blt->Red = BmpColorMap[Index].Red;
Blt->Green = BmpColorMap[Index].Green;
Blt->Blue = BmpColorMap[Index].Blue;
if (Width < (BmpHeader->PixelWidth - 1)) {
Blt++;
Width++;
Index = (*Image) & 0x0f;
Blt->Red = BmpColorMap[Index].Red;
Blt->Green = BmpColorMap[Index].Green;
Blt->Blue = BmpColorMap[Index].Blue;
}
break;
case 8:
//
// Convert 8-bit (256 colors) BMP Palette to 24-bit color
//
Blt->Red = BmpColorMap[*Image].Red;
Blt->Green = BmpColorMap[*Image].Green;
Blt->Blue = BmpColorMap[*Image].Blue;
break;
case 24:
//
// It is 24-bit BMP.
//
Blt->Blue = *Image++;
Blt->Green = *Image++;
Blt->Red = *Image;
break;
case 32:
//
// it is 32-bit BMP. Skip pixel's highest byte
//
Blt->Blue = *Image++;
Blt->Green = *Image++;
Blt->Red = *Image++;
break;
default:
//
// Other bit format BMP is not supported.
//
if (IsAllocated) {
FreePool (*GopBlt);
*GopBlt = NULL;
}
return EFI_UNSUPPORTED;
};
}
ImageIndex = (UINTN) Image - (UINTN) ImageHeader;
if ((ImageIndex % 4) != 0) {
//
// Bmp Image starts each row on a 32-bit boundary!
//
Image = Image + (4 - (ImageIndex % 4));
}
}
return EFI_SUCCESS;
}
/** /**
Those capsules supported by the firmwares. Those capsules supported by the firmwares.
@ -620,10 +364,10 @@ DisplayCapsuleImage (
Blt = NULL; Blt = NULL;
Width = 0; Width = 0;
Height = 0; Height = 0;
Status = ConvertBmpToGopBlt ( Status = TranslateBmpToGopBlt (
ImagePayload + 1, ImagePayload + 1,
PayloadSize - sizeof(DISPLAY_DISPLAY_PAYLOAD), PayloadSize - sizeof(DISPLAY_DISPLAY_PAYLOAD),
(VOID **)&Blt, &Blt,
&BltSize, &BltSize,
&Height, &Height,
&Width &Width

3
MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleLib.inf
View File

@ -3,7 +3,7 @@
# #
# Capsule library instance for DXE_DRIVER module types. # Capsule library instance for DXE_DRIVER module types.
# #
# Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR> # Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
# This program and the accompanying materials # This program and the accompanying materials
# are licensed and made available under the terms and conditions of the BSD License # are licensed and made available under the terms and conditions of the BSD License
# which accompanies this distribution. The full text of the license may be found at # which accompanies this distribution. The full text of the license may be found at
@ -51,6 +51,7 @@
ReportStatusCodeLib ReportStatusCodeLib
PrintLib PrintLib
HobLib HobLib
BmpSupportLib
[Pcd] [Pcd]
gEfiMdeModulePkgTokenSpaceGuid.PcdCapsuleMax ## CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdCapsuleMax ## CONSUMES

3
MdeModulePkg/Library/DxeCapsuleLibFmp/DxeRuntimeCapsuleLib.inf
View File

@ -3,7 +3,7 @@
# #
# Capsule library instance for DXE_RUNTIME_DRIVER module types. # Capsule library instance for DXE_RUNTIME_DRIVER module types.
# #
# Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR> # Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
# This program and the accompanying materials # This program and the accompanying materials
# are licensed and made available under the terms and conditions of the BSD License # are licensed and made available under the terms and conditions of the BSD License
# which accompanies this distribution. The full text of the license may be found at # which accompanies this distribution. The full text of the license may be found at
@ -54,6 +54,7 @@
ReportStatusCodeLib ReportStatusCodeLib
PrintLib PrintLib
HobLib HobLib
BmpSupportLib
[Pcd] [Pcd]
gEfiMdeModulePkgTokenSpaceGuid.PcdCapsuleMax ## CONSUMES gEfiMdeModulePkgTokenSpaceGuid.PcdCapsuleMax ## CONSUMES

2
MdeModulePkg/MdeModulePkg.dsc
View File

@ -106,6 +106,8 @@
FmpAuthenticationLib|MdeModulePkg/Library/FmpAuthenticationLibNull/FmpAuthenticationLibNull.inf FmpAuthenticationLib|MdeModulePkg/Library/FmpAuthenticationLibNull/FmpAuthenticationLibNull.inf
CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf
BmpSupportLib|MdeModulePkg/Library/BaseBmpSupportLib/BaseBmpSupportLib.inf
SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf
[LibraryClasses.EBC.PEIM] [LibraryClasses.EBC.PEIM]
IoLib|MdePkg/Library/PeiIoLibCpuIo/PeiIoLibCpuIo.inf IoLib|MdePkg/Library/PeiIoLibCpuIo/PeiIoLibCpuIo.inf