mirror of https://github.com/acidanthera/audk.git
SecurityPkg/DxeImageVerificationLib: assign WinCertificate after size check
Currently the (SecDataDirLeft <= sizeof (WIN_CERTIFICATE)) check only guards the de-referencing of the "WinCertificate" pointer. It does not guard the calculation of the pointer itself: WinCertificate = (WIN_CERTIFICATE *) (mImageBase + OffSet); This is wrong; if we don't know for sure that we have enough room for a WIN_CERTIFICATE, then even creating such a pointer, not just de-referencing it, may invoke undefined behavior. Move the pointer calculation after the size check. Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Min Xu <min.m.xu@intel.com> Cc: Wenyi Xie <xiewenyi2@huawei.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2215 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20200901091221.20948-3-lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Wenyi Xie <xiewenyi2@huawei.com> Reviewed-by: Min M Xu <min.m.xu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
This commit is contained in:
parent
503248ccdf
commit
a7632e913c
|
@ -1855,10 +1855,12 @@ DxeImageVerificationHandler (
|
||||||
for (OffSet = SecDataDir->VirtualAddress;
|
for (OffSet = SecDataDir->VirtualAddress;
|
||||||
OffSet < SecDataDirEnd;
|
OffSet < SecDataDirEnd;
|
||||||
OffSet += (WinCertificate->dwLength + ALIGN_SIZE (WinCertificate->dwLength))) {
|
OffSet += (WinCertificate->dwLength + ALIGN_SIZE (WinCertificate->dwLength))) {
|
||||||
WinCertificate = (WIN_CERTIFICATE *) (mImageBase + OffSet);
|
|
||||||
SecDataDirLeft = SecDataDirEnd - OffSet;
|
SecDataDirLeft = SecDataDirEnd - OffSet;
|
||||||
if (SecDataDirLeft <= sizeof (WIN_CERTIFICATE) ||
|
if (SecDataDirLeft <= sizeof (WIN_CERTIFICATE)) {
|
||||||
SecDataDirLeft < WinCertificate->dwLength) {
|
break;
|
||||||
|
}
|
||||||
|
WinCertificate = (WIN_CERTIFICATE *) (mImageBase + OffSet);
|
||||||
|
if (SecDataDirLeft < WinCertificate->dwLength) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue