tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/UdfDxe: Avoid possible use of already-freed data 

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1255

For function ReadFile():

If the line

  Status = GetAedAdsData (
   ...
   );

is reached multiple times during the 'for' loop, freeing the data pointed
by variable 'Data' may potentially lead to variable 'Ad' referencing the
already-freed data.

After calling function GetAllocationDescriptor(), 'Data' and 'Ad' may
point to the same memory (with some possible offset). Hence, this commit
will move the FreePool() call backwards to ensure the data will no longer
be used.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Paulo Alcantara <palcantara@suse.de>
Acked-by: Star Zeng <star.zeng@intel.com>
This commit is contained in:
Hao Wu 2018-10-16 13:09:43 +08:00
parent 85acb5e8ff
commit 68099b52b0
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
View File

@ -1078,6 +1078,7 @@ ReadFile (
EFI_STATUS Status;
UINT32 LogicalBlockSize;
VOID *Data;
VOID *DataBak;
UINT64 Length;
VOID *Ad;
UINT64 AdOffset;
@ -1218,12 +1219,7 @@ ReadFile (
// Descriptor and its extents (ADs).
//
if (GET_EXTENT_FLAGS (RecordingFlags, Ad) == ExtentIsNextExtent) {
if (!DoFreeAed) {
DoFreeAed = TRUE;
} else {
FreePool (Data);
}
DataBak = Data;
Status = GetAedAdsData (
BlockIo,
DiskIo,
@ -1234,6 +1230,13 @@ ReadFile (
&Data,
&Length
);
if (!DoFreeAed) {
DoFreeAed = TRUE;
} else {
FreePool (DataBak);
}
if (EFI_ERROR (Status)) {
goto Error_Get_Aed;
}