tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/UdfDxe: Memory free/use after free in ResolveSymlink() 

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1279

For function ResolveSymlink(), the below codes:

    if (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent,
                    sizeof (UDF_FILE_INFO)) != 0) {
      CleanupFileInformation (&PreviousFile);
    }

    CopyMem ((VOID *)&PreviousFile, (VOID *)File, sizeof (UDF_FILE_INFO));

If the contents in 'PreviousFile' and 'File' are the same, call to
"CleanupFileInformation (&PreviousFile);" will free the buffers in 'File'
as well. This will lead to potential memory double free/use after free
issues.

This commit will add additional check to address the above issue.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Paulo Alcantara <palcantara@suse.de>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
This commit is contained in:
Hao Wu 2018-10-30 09:17:04 +08:00
parent bfb8c64cbf
commit 27b9cb33e7
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
View File

@ -2144,6 +2144,8 @@ ResolveSymlink (
UINTN Index;
UINT8 CompressionId;
UDF_FILE_INFO PreviousFile;
BOOLEAN NotParent;
BOOLEAN NotFile;
ZeroMem ((VOID *)File, sizeof (UDF_FILE_INFO));
@ -2298,12 +2300,18 @@ ResolveSymlink (
goto Error_Find_File;
}
if (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent,
sizeof (UDF_FILE_INFO)) != 0) {
NotParent = (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent,
sizeof (UDF_FILE_INFO)) != 0);
NotFile = (CompareMem ((VOID *)&PreviousFile, (VOID *)File,
sizeof (UDF_FILE_INFO)) != 0);
if (NotParent && NotFile) {
CleanupFileInformation (&PreviousFile);
}
CopyMem ((VOID *)&PreviousFile, (VOID *)File, sizeof (UDF_FILE_INFO));
if (NotFile) {
CopyMem ((VOID *)&PreviousFile, (VOID *)File, sizeof (UDF_FILE_INFO));
}
}
//