tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdePkg/BaseLib: Fix out-of-bounds reads in SafeString 

There was a OOB access in *StrHexTo* functions, when passed strings like
"XDEADBEEF".

OpenCore folks established an ASAN-equipped project to fuzz Ext4Dxe,
which was able to catch these (mostly harmless) issues.

Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Cc: Marvin H?user <mhaeuser@posteo.de>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@Intel.com>
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
This commit is contained in:
Pedro Falcato 2022-11-03 09:11:49 +08:00 committed by mergify[bot]
parent b556f2445c
commit 35043a5ec0
1 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
MdePkg/Library/BaseLib/SafeString.c
View File

@ -863,6 +863,9 @@ StrHexToUintnS (
OUT UINTN *Data
)
{
BOOLEAN FoundLeadingZero;
FoundLeadingZero = FALSE;
ASSERT (((UINTN)String & BIT0) == 0);
//
@ -892,12 +895,14 @@ StrHexToUintnS (
//
// Ignore leading Zeros after the spaces
//
FoundLeadingZero = *String == L'0';
while (*String == L'0') {
String++;
}
if (CharToUpper (*String) == L'X') {
if (*(String - 1) != L'0') {
if (!FoundLeadingZero) {
*Data = 0;
return RETURN_SUCCESS;
}
@ -992,6 +997,9 @@ StrHexToUint64S (
OUT UINT64 *Data
)
{
BOOLEAN FoundLeadingZero;
FoundLeadingZero = FALSE;
ASSERT (((UINTN)String & BIT0) == 0);
//
@ -1021,12 +1029,13 @@ StrHexToUint64S (
//
// Ignore leading Zeros after the spaces
//
FoundLeadingZero = *String == L'0';
while (*String == L'0') {
String++;
}
if (CharToUpper (*String) == L'X') {
if (*(String - 1) != L'0') {
if (!FoundLeadingZero) {
*Data = 0;
return RETURN_SUCCESS;
}
@ -2393,6 +2402,9 @@ AsciiStrHexToUintnS (
OUT UINTN *Data
)
{
BOOLEAN FoundLeadingZero;
FoundLeadingZero = FALSE;
//
// 1. Neither String nor Data shall be a null pointer.
//
@ -2420,12 +2432,13 @@ AsciiStrHexToUintnS (
//
// Ignore leading Zeros after the spaces
//
FoundLeadingZero = *String == '0';
while (*String == '0') {
String++;
}
if (AsciiCharToUpper (*String) == 'X') {
if (*(String - 1) != '0') {
if (!FoundLeadingZero) {
*Data = 0;
return RETURN_SUCCESS;
}
@ -2517,6 +2530,9 @@ AsciiStrHexToUint64S (
OUT UINT64 *Data
)
{
BOOLEAN FoundLeadingZero;
FoundLeadingZero = FALSE;
//
// 1. Neither String nor Data shall be a null pointer.
//
@ -2544,12 +2560,13 @@ AsciiStrHexToUint64S (
//
// Ignore leading Zeros after the spaces
//
FoundLeadingZero = *String == '0';
while (*String == '0') {
String++;
}
if (AsciiCharToUpper (*String) == 'X') {
if (*(String - 1) != '0') {
if (!FoundLeadingZero) {
*Data = 0;
return RETURN_SUCCESS;
}