tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
audk/SecurityPkg/VariableAuthenticated/RuntimeDxe
History
Laszlo Ersek d547f31c32 SecurityPkg: VariableServiceSetVariable(): fix dbt <-> GUID association 
SVN r16380 ("UEFI 2.4 X509 Certificate Hash and RFC3161 Timestamp
Verification support for Secure Boot") broke the "dbt" variable's
association with its expected namespace GUID.

According to "MdePkg/Include/Guid/ImageAuthentication.h", *all* of the
"db", "dbx", and "dbt" (== EFI_IMAGE_SECURITY_DATABASE2) variables have
their special meanings in the EFI_IMAGE_SECURITY_DATABASE_GUID namespace.

However, the above commit introduced the following expression in
VariableServiceSetVariable():

> -  } else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
> -          ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))) {
> +  } else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
> +          ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))
> +           || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2)) == 0) {

Simply replacing the individual expressions with the predicates
"GuidMatch", "DbMatch", "DbxMatch", and "DbtMatch", the above
transformation becomes:

> -  } else if (GuidMatch &&
> -          ((DbMatch) || (DbxMatch))) {
> +  } else if (GuidMatch &&
> +          ((DbMatch) || (DbxMatch))
> +           || DbtMatch) {

In shorter form, we change

  GuidMatch && (DbMatch || DbxMatch)

into

  GuidMatch && (DbMatch || DbxMatch) || DbtMatch

which is incorrect, because this way "dbt" will match outside of the
intended namespace / GUID.

The error was caught by gcc:

> SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c: In function
> 'VariableServiceSetVariable':
>
> SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c:3188:71: error:
> suggest parentheses around '&&' within '||' [-Werror=parentheses]
>
>    } else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
>                                                                        ^
> cc1: all warnings being treated as errors

Fix the parentheses.

This change may have security implications.

Contributed-under: TianoCore Contribution Agreement 1.0

Signed-off-by: Laszlo Ersek <lersek@redhat.com>

Reviewed-by: Qin Long <qin.long@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16389 6f19259b-4bc3-4df7-8a09-765794883524
 		2014-11-14 13:47:14 +00:00
..
AuthService.c UEFI 2.4 X509 Certificate Hash and RFC3161 Timestamp Verification support for Secure Boot 2014-11-14 08:41:12 +00:00
AuthService.h Add comments to clarify mPubKeyStore buffer MemCopy. There is no memory overflow issue. 2014-10-22 07:30:22 +00:00
Measurement.c Fix execution status & DEBUG message level mismatch. EFI_D_ERROR is used only when failure/case can’t be resolved by code. 2014-11-10 05:01:15 +00:00
Reclaim.c Update code to support VS2013 tool chain. 2014-07-28 07:45:49 +00:00
Variable.c SecurityPkg: VariableServiceSetVariable(): fix dbt <-> GUID association 2014-11-14 13:47:14 +00:00
Variable.h Calculate enough space for 2 variables (public key and variable data) instead of directly setting them 1 by 1. 2014-03-27 10:54:23 +00:00
VariableAuthRuntimeDxe.uni SecurityPkg: Convert non DOS format files to DOS format 2014-09-03 08:51:17 +00:00
VariableAuthSmm.uni SecurityPkg: Convert non DOS format files to DOS format 2014-09-03 08:51:17 +00:00
VariableAuthSmmRuntimeDxe.uni SecurityPkg: Convert non DOS format files to DOS format 2014-09-03 08:51:17 +00:00
VariableDxe.c SecurityPkg VariableRuntimeDxe: Bug fix and and refine debug message. 2014-09-03 09:19:30 +00:00
VariableRuntimeDxe.inf SecurityPkg: INF/DEC file updates to EDK II packages 2014-08-28 05:31:09 +00:00
VariableRuntimeDxeExtra.uni SecurityPkg: INF/DEC file updates to EDK II packages 2014-08-28 05:34:23 +00:00
VariableSmm.c Fix the return value bug when updating public key database variable failure. 2014-03-19 03:12:57 +00:00
VariableSmm.inf Add comments to clarify mPubKeyStore buffer MemCopy. There is no memory overflow issue. 2014-10-22 07:30:22 +00:00
VariableSmmExtra.uni SecurityPkg: INF/DEC file updates to EDK II packages 2014-08-28 05:34:23 +00:00
VariableSmmRuntimeDxe.c Update code to support VS2013 tool chain. 2014-07-28 07:45:49 +00:00
VariableSmmRuntimeDxe.inf Add comments to clarify mPubKeyStore buffer MemCopy. There is no memory overflow issue. 2014-10-22 07:30:22 +00:00
VariableSmmRuntimeDxeExtra.uni SecurityPkg: INF/DEC file updates to EDK II packages 2014-08-28 05:34:23 +00:00