tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg FileExplorerLib: Fix potential Integer Overflow. 

In function 'LibAppendFileName' of 'FileExplorer.c':
"
MaxLen = (Size1 + Size2 + sizeof (CHAR16))/ sizeof (CHAR16);
"
Overflow may happen here. MaxLen might become a very small number.
This patch adds integer overflow checker.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
This commit is contained in:
Liming Gao 2016-10-14 14:49:54 +08:00
parent 9ba2869c7e
commit aaba2a44c2
1 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
MdeModulePkg/Library/FileExplorerLib/FileExplorer.c
View File

@ -620,6 +620,14 @@ LibAppendFileName (
Size1 = StrSize (Str1);
Size2 = StrSize (Str2);
//
// Check overflow
//
if (((MAX_UINTN - Size1) < Size2) || ((MAX_UINTN - Size1 - Size2) < sizeof(CHAR16))) {
return NULL;
}
MaxLen = (Size1 + Size2 + sizeof (CHAR16))/ sizeof (CHAR16);
Str = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));
ASSERT (Str != NULL);
@ -963,6 +971,7 @@ LibGetFileHandleFromDevicePath (
// the file system support below to be skipped.
//
Status = EFI_OUT_OF_RESOURCES;
goto Done;
}
//
@ -992,6 +1001,11 @@ LibGetFileHandleFromDevicePath (
*ParentFileName = AllocateCopyPool (StrSize (((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName), ((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName);
} else {
TempPath = LibAppendFileName (*ParentFileName, ((FILEPATH_DEVICE_PATH *) DevicePathNode)->PathName);
if (TempPath == NULL) {
LastHandle->Close (LastHandle);
Status = EFI_OUT_OF_RESOURCES;
goto Done;
}
FreePool (*ParentFileName);
*ParentFileName = TempPath;
}
@ -1067,12 +1081,14 @@ LibFindFiles (
// Pass 1 to get Directories
// Pass 2 to get files that are EFI images
//
Status = EFI_SUCCESS;
for (Pass = 1; Pass <= 2; Pass++) {
FileHandle->SetPosition (FileHandle, 0);
for (;;) {
BufferSize = DirBufferSize;
Status = FileHandle->Read (FileHandle, &BufferSize, DirInfo);
if (EFI_ERROR (Status) || BufferSize == 0) {
Status = EFI_SUCCESS;
break;
}
@ -1095,12 +1111,18 @@ LibFindFiles (
NewMenuEntry = LibCreateMenuEntry ();
if (NULL == NewMenuEntry) {
return EFI_OUT_OF_RESOURCES;
Status = EFI_OUT_OF_RESOURCES;
goto Done;
}
NewFileContext = (FILE_CONTEXT *) NewMenuEntry->VariableContext;
NewFileContext->DeviceHandle = DeviceHandle;
NewFileContext->FileName = LibAppendFileName (FileName, DirInfo->FileName);
if (NewFileContext->FileName == NULL) {
LibDestroyMenuEntry (NewMenuEntry);
Status = EFI_OUT_OF_RESOURCES;
goto Done;
}
NewFileContext->FileHandle = FileHandle;
NewFileContext->DevicePath = FileDevicePath (NewFileContext->DeviceHandle, NewFileContext->FileName);
NewMenuEntry->HelpString = NULL;
@ -1135,9 +1157,11 @@ LibFindFiles (
gFileExplorerPrivate.FsOptionMenu->MenuNumber = OptionNumber;
Done:
FreePool (DirInfo);
return EFI_SUCCESS;
return Status;
}
/**