tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/UdfDxe: Add checks to ensure no possible NULL ptr deref 

Case 1 - Within DuplicateFid() & DuplicateFe():
The call to AllocateCopyPool() may return NULL.
Add ASSERTs as checks.

Case 2 - Within UdfRead():
Add ASSERT to ensure 'NewFileEntryData' returned from FindFileEntry()
will not be NULL pointer.

Case 3 - Within GetAllocationDescriptorLsn():
The return value of 'GetPdFromLongAd (Volume, ParentIcb)' may be NULL,
and it will be passed into function GetShortAdLsn() which will
dereference it.
Add ASSERT in GetShortAdLsn() as check.

Case 4 - Within ReadFile():
Add ASSERT to ensure 'Data' returned from GetAedAdsData() will not be NULL
pointer.

Case 5 - Within InternalFindFile():
If both 'Parent->FileIdentifierDesc' and 'Icb' are NULL, then possible
NULL pointer dereference will happen in ReadDirectoryEntry().
Add additional check to resolve.

Cc: Paulo Alcantara <pcacjr@zytor.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Paulo Alcantara <pcacjr@zytor.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
This commit is contained in:
Hao Wu 2017-09-14 10:15:53 +08:00
parent 91cc526b15
commit 3fa40d588a
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
MdeModulePkg/Universal/Disk/UdfDxe/File.c
View File

@ -427,6 +427,7 @@ UdfRead (
if (EFI_ERROR (Status)) {
goto Error_Find_Fe;
}
ASSERT (NewFileEntryData != NULL);
if (IS_FE_SYMLINK (NewFileEntryData)) {
Status = ResolveSymlink (

18
MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
View File

@ -297,6 +297,8 @@ GetShortAdLsn (
IN UDF_SHORT_ALLOCATION_DESCRIPTOR *ShortAd
)
{
ASSERT (PartitionDesc != NULL);
return (UINT64)PartitionDesc->PartitionStartingLocation +
ShortAd->ExtentPosition;
}
@ -480,6 +482,8 @@ DuplicateFid (
*NewFileIdentifierDesc =
(UDF_FILE_IDENTIFIER_DESCRIPTOR *)AllocateCopyPool (
(UINTN) GetFidDescriptorLength (FileIdentifierDesc), FileIdentifierDesc);
ASSERT (*NewFileIdentifierDesc != NULL);
}
//
@ -494,6 +498,8 @@ DuplicateFe (
)
{
*NewFileEntry = AllocateCopyPool (Volume->FileEntrySize, FileEntry);
ASSERT (*NewFileEntry != NULL);
}
//
@ -1028,6 +1034,7 @@ ReadFile (
if (EFI_ERROR (Status)) {
goto Error_Get_Aed;
}
ASSERT (Data != NULL);
AdOffset = 0;
continue;
@ -1208,6 +1215,13 @@ InternalFindFile (
CHAR16 FoundFileName[UDF_FILENAME_LENGTH];
VOID *CompareFileEntry;
//
// Check if both Parent->FileIdentifierDesc and Icb are NULL.
//
if ((Parent->FileIdentifierDesc == NULL) && (Icb == NULL)) {
return EFI_INVALID_PARAMETER;
}
//
// Check if parent file is really directory.
//
@ -1220,6 +1234,10 @@ InternalFindFile (
// FE/EFE and FID descriptors.
//
if (StrCmp (FileName, L".") == 0) {
if (Parent->FileIdentifierDesc == NULL) {
return EFI_INVALID_PARAMETER;
}
DuplicateFe (BlockIo, Volume, Parent->FileEntry, &File->FileEntry);
DuplicateFid (Parent->FileIdentifierDesc, &File->FileIdentifierDesc);