tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/UsbBusPei: Fix out-of-bound read access to descriptors 

Today's implementation reads the Type/Length field in the USB
descriptors data without checking whether the offset to read is
beyond the data boundary.

The patch fixes this issue by syncing the fix in commit
4c034bf62c
*MdeModulePkg/UsbBus: Fix out-of-bound read access to descriptors

ParsedBytes in UsbBusPei.GetExpectedDescriptor() is different from
Consumed in UsbBusDxe.UsbCreateDesc().
ParsedBytes is the offset of found descriptor while Consumed is
offset of next descriptor of found one.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
This commit is contained in:
Ruiyu Ni 2018-10-25 17:07:12 +08:00
parent 2f6693c283
commit c96de1dbae
2 changed files with 54 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c
View File

@ -940,59 +940,64 @@ GetExpectedDescriptor (
OUT UINTN *ParsedBytes
)
{
UINT16 DescriptorHeader;
UINT8 Len;
UINT8 *Ptr;
UINTN Parsed;
USB_DESC_HEAD *Head;
UINTN Offset;
Parsed = 0;
Ptr = Buffer;
//
// Total length is too small that cannot hold the single descriptor header plus data.
//
if (Length <= sizeof (USB_DESC_HEAD)) {
DEBUG ((DEBUG_ERROR, "GetExpectedDescriptor: met mal-format descriptor, total length = %d!\n", Length));
return EFI_DEVICE_ERROR;
}
while (TRUE) {
//
// All the descriptor has a common LTV (Length, Type, Value)
// format. Skip the descriptor that isn't of this Type
//
Offset = 0;
Head = (USB_DESC_HEAD *)Buffer;
while (Offset < Length - sizeof (USB_DESC_HEAD)) {
//
// Buffer length should not less than Desc length
// Above condition make sure Head->Len and Head->Type are safe to access
//
if (Length < DescLength) {
Head = (USB_DESC_HEAD *)&Buffer[Offset];
if (Head->Len == 0) {
DEBUG ((DEBUG_ERROR, "GetExpectedDescriptor: met mal-format descriptor, Head->Len = 0!\n"));
return EFI_DEVICE_ERROR;
}
DescriptorHeader = (UINT16) (*Ptr + ((*(Ptr + 1)) << 8));
Len = Buffer[0];
//
// Check to see if it is a start of expected descriptor
// Make sure no overflow when adding Head->Len to Offset.
//
if (DescriptorHeader == ((DescType << 8) | DescLength)) {
if (Head->Len > MAX_UINTN - Offset) {
DEBUG ((DEBUG_ERROR, "GetExpectedDescriptor: met mal-format descriptor, Head->Len = %d!\n", Head->Len));
return EFI_DEVICE_ERROR;
}
if (Head->Type == DescType) {
break;
}
if ((UINT8) (DescriptorHeader >> 8) == DescType) {
if (Len > DescLength) {
return EFI_DEVICE_ERROR;
}
}
//
// Descriptor length should be at least 2
// and should not exceed the buffer length
//
if (Len < 2) {
return EFI_DEVICE_ERROR;
}
if (Len > Length) {
return EFI_DEVICE_ERROR;
}
//
// Skip this mismatch descriptor
//
Length -= Len;
Ptr += Len;
Parsed += Len;
Offset += Head->Len;
}
*ParsedBytes = Parsed;
//
// Head->Len is invalid resulting data beyond boundary, or
// Descriptor cannot be found: No such type.
//
if (Length < Offset) {
DEBUG ((DEBUG_ERROR, "GetExpectedDescriptor: met mal-format descriptor, Offset/Len = %d/%d!\n", Offset, Length));
return EFI_DEVICE_ERROR;
}
if ((Head->Type != DescType) || (Head->Len < DescLength)) {
DEBUG ((DEBUG_ERROR, "GetExpectedDescriptor: descriptor cannot be found, Header(T/L) = %d/%d!\n", Head->Type, Head->Len));
return EFI_DEVICE_ERROR;
}
*ParsedBytes = Offset;
return EFI_SUCCESS;
}

11
MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.h
View File

@ -33,6 +33,17 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#include <IndustryStandard/Usb.h>
//
// A common header for usb standard descriptor.
// Each stand descriptor has a length and type.
//
#pragma pack(1)
typedef struct {
UINT8 Len;
UINT8 Type;
} USB_DESC_HEAD;
#pragma pack()
#define MAX_INTERFACE 8
#define MAX_ENDPOINT 16