Projects
openEuler:20.03:LTS:SP3
edk2
_service:tar_scm_kernel_repo:0006-MdeModulePkg-...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm_kernel_repo:0006-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch of Package edk2
From e7bd0dd26db7e56aa8ca70132d6ea916ee6f3db0 Mon Sep 17 00:00:00 2001 From: Laszlo Ersek <lersek@redhat.com> Date: Thu, 19 Nov 2020 12:50:34 +0100 Subject: [PATCH] MdeModulePkg/LzmaCustomDecompressLib: catch 4GB+ uncompressed buffer sizes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The LzmaUefiDecompressGetInfo() function [MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c] currently silently truncates the UINT64 "DecodedSize" property of the compressed blob to the UINT32 "DestinationSize" output parameter. If "DecodedSize" is 0x1_0000_0100, for example, then the subsequent memory allocation (for decompression) will likely succeed (allocating 0x100 bytes only), but then the LzmaUefiDecompress() function (which re-fetches the uncompressed buffer size from the same LZMA header into a "SizeT" variable) will overwrite the buffer. Catch (DecodedSize > MAX_UINT32) in LzmaUefiDecompressGetInfo() at once. This should not be a practical limitation. (The issue cannot be fixed for 32-bit systems without spec modifications anyway, given that the "OutputSize" output parameter of EFI_GUIDED_SECTION_EXTRACTION_PROTOCOL.ExtractSection() has type UINTN, not UINT64.) Cc: Dandan Bi <dandan.bi@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1816 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20201119115034.12897-2-lersek@redhat.com> --- .../Library/LzmaCustomDecompressLib/LzmaDecompress.c | 7 +++++++ .../LzmaCustomDecompressLib/LzmaDecompressLibInternal.h | 5 +++++ 2 files changed, 12 insertions(+) diff --git a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c index c58912eb6a..8f7c242dca 100644 --- a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c +++ b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c @@ -127,6 +127,10 @@ GetDecodedSizeOfBuf( in DestinationSize and the size of the scratch buffer was returned in ScratchSize. + @retval RETURN_UNSUPPORTED DestinationSize cannot be output because the + uncompressed buffer size (in bytes) does not fit + in a UINT32. Output parameters have not been + modified. **/ RETURN_STATUS EFIAPI @@ -142,6 +146,9 @@ LzmaUefiDecompressGetInfo ( ASSERT(SourceSize >= LZMA_HEADER_SIZE); DecodedSize = GetDecodedSizeOfBuf((UINT8*)Source); + if (DecodedSize > MAX_UINT32) { + return RETURN_UNSUPPORTED; + } *DestinationSize = (UINT32)DecodedSize; *ScratchSize = SCRATCH_BUFFER_REQUEST_SIZE; diff --git a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h index 26f110ba2a..fbafd5f100 100644 --- a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h +++ b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h @@ -9,6 +9,7 @@ #ifndef __LZMADECOMPRESSLIB_INTERNAL_H__ #define __LZMADECOMPRESSLIB_INTERNAL_H__ +#include <Base.h> #include <PiPei.h> #include <Library/BaseLib.h> #include <Library/BaseMemoryLib.h> @@ -45,6 +46,10 @@ in DestinationSize and the size of the scratch buffer was returned in ScratchSize. + @retval RETURN_UNSUPPORTED DestinationSize cannot be output because the + uncompressed buffer size (in bytes) does not fit + in a UINT32. Output parameters have not been + modified. **/ RETURN_STATUS EFIAPI -- 2.27.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.