Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP3:GA
ovmf.9469
ovmf-bsc1115917-bounds-checking-for-ueficompres...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File ovmf-bsc1115917-bounds-checking-for-ueficompress.patch of Package ovmf.9469
From 2c959247bf82755fd38a5001238e6f0ccd6cf07f Mon Sep 17 00:00:00 2001 From: Liming Gao <liming.gao@intel.com> Date: Tue, 16 Oct 2018 10:06:11 +0800 Subject: [PATCH 1/7] MdePkg: Add more checker in UefiDecompressLib to access the valid buffer only (CVE FIX) Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735 https://bugzilla.tianocore.org/show_bug.cgi?id=686 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com> Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit 2ec7953d49677142c5f7552e9e3d96fb406ba0c4) --- .../BaseUefiDecompressLib.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c index e818543d9255..0c6b1fe4ee83 100644 --- a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c +++ b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c @@ -152,6 +152,7 @@ MakeTable ( UINT16 Mask; UINT16 WordOfStart; UINT16 WordOfCount; + UINT16 MaxTableLength; // // The maximum mapping table width supported by this internal @@ -164,6 +165,9 @@ MakeTable ( } for (Index = 0; Index < NumOfChar; Index++) { + if (BitLen[Index] > 16) { + return (UINT16) BAD_TABLE; + } Count[BitLen[Index]]++; } @@ -205,6 +209,7 @@ MakeTable ( Avail = NumOfChar; Mask = (UINT16) (1U << (15 - TableBits)); + MaxTableLength = (UINT16) (1U << TableBits); for (Char = 0; Char < NumOfChar; Char++) { @@ -218,6 +223,9 @@ MakeTable ( if (Len <= TableBits) { for (Index = Start[Len]; Index < NextCode; Index++) { + if (Index >= MaxTableLength) { + return (UINT16) BAD_TABLE; + } Table[Index] = Char; } @@ -620,11 +628,16 @@ Decode ( // Write BytesRemain of bytes into mDstBase // BytesRemain--; + while ((INT16) (BytesRemain) >= 0) { - Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++]; if (Sd->mOutBuf >= Sd->mOrigSize) { goto Done; } + if (DataIdx >= Sd->mOrigSize) { + Sd->mBadTableFlag = (UINT16) BAD_TABLE; + goto Done; + } + Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++]; BytesRemain--; } @@ -694,7 +707,7 @@ UefiDecompressGetInfo ( } CompressedSize = ReadUnaligned32 ((UINT32 *)Source); - if (SourceSize < (CompressedSize + 8)) { + if (SourceSize < (CompressedSize + 8) || (CompressedSize + 8) < 8) { return RETURN_INVALID_PARAMETER; } -- 2.19.1 From 7c0b8f75fc6bcb0e10a5b55f1ba73d764752202a Mon Sep 17 00:00:00 2001 From: Liming Gao <liming.gao@intel.com> Date: Tue, 16 Oct 2018 10:06:12 +0800 Subject: [PATCH 2/7] IntelFrameworkModulePkg: Add more checker in UefiTianoDecompressLib (CVE FIX) Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735 https://bugzilla.tianocore.org/show_bug.cgi?id=686 To make sure the valid buffer be accessed only. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com> Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit 684db6da64bc7b5faee4e1174e801c245f563b5c) --- .../BaseUefiTianoCustomDecompressLib.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c index cb009e7771bb..9b001667ef7e 100644 --- a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c +++ b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c @@ -143,6 +143,7 @@ MakeTable ( UINT16 Mask; UINT16 WordOfStart; UINT16 WordOfCount; + UINT16 MaxTableLength; // // The maximum mapping table width supported by this internal @@ -155,6 +156,9 @@ MakeTable ( } for (Index = 0; Index < NumOfChar; Index++) { + if (BitLen[Index] > 16) { + return (UINT16) BAD_TABLE; + } Count[BitLen[Index]]++; } @@ -196,6 +200,7 @@ MakeTable ( Avail = NumOfChar; Mask = (UINT16) (1U << (15 - TableBits)); + MaxTableLength = (UINT16) (1U << TableBits); for (Char = 0; Char < NumOfChar; Char++) { @@ -209,6 +214,9 @@ MakeTable ( if (Len <= TableBits) { for (Index = Start[Len]; Index < NextCode; Index++) { + if (Index >= MaxTableLength) { + return (UINT16) BAD_TABLE; + } Table[Index] = Char; } @@ -615,10 +623,14 @@ Decode ( // BytesRemain--; while ((INT16) (BytesRemain) >= 0) { - Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++]; if (Sd->mOutBuf >= Sd->mOrigSize) { goto Done ; } + if (DataIdx >= Sd->mOrigSize) { + Sd->mBadTableFlag = (UINT16) BAD_TABLE; + goto Done ; + } + Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++]; BytesRemain--; } @@ -688,7 +700,7 @@ UefiDecompressGetInfo ( } CompressedSize = ReadUnaligned32 ((UINT32 *)Source); - if (SourceSize < (CompressedSize + 8)) { + if (SourceSize < (CompressedSize + 8) || (CompressedSize + 8) < 8) { return RETURN_INVALID_PARAMETER; } -- 2.19.1 From 997784f1a89fbee08cacf5efbcb3ff380dac2c33 Mon Sep 17 00:00:00 2001 From: Yunhua Feng <yunhuax.feng@intel.com> Date: Sun, 30 Sep 2018 11:07:18 +0800 Subject: [PATCH 3/7] BaseTools: Add --uefi option to enable UefiCompress method Add one new option --uefi to enable UefiCompress. (re-add this patch since it be reverted in Python3 migration patches, but this patch is not related with Python3) Cc: Liming Gao <liming.gao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Yunhua Feng <yunhuax.feng@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com> (cherry picked from commit f1400101a732ee2e7e0f6d53712caec77ff695f9) --- .../Source/C/TianoCompress/TianoCompress.c | 85 +++++++++++++------ .../Source/C/TianoCompress/TianoCompress.h | 2 +- 2 files changed, 60 insertions(+), 27 deletions(-) diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c index 046fb36a178d..4bd341e36d03 100644 --- a/BaseTools/Source/C/TianoCompress/TianoCompress.c +++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c @@ -17,6 +17,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. **/ #include "Compress.h" +#include "Decompress.h" #include "TianoCompress.h" #include "EfiUtilityMsgs.h" #include "ParseInf.h" @@ -65,6 +66,7 @@ static BOOLEAN QuietMode = FALSE; // STATIC BOOLEAN ENCODE = FALSE; STATIC BOOLEAN DECODE = FALSE; +STATIC BOOLEAN UEFIMODE = FALSE; STATIC UINT8 *mSrc, *mDst, *mSrcUpperLimit, *mDstUpperLimit; STATIC UINT8 *mLevel, *mText, *mChildCount, *mBuf, mCLen[NC], mPTLen[NPT], *mLen; STATIC INT16 mHeap[NC + 1]; @@ -1703,6 +1705,8 @@ Returns: // Details Option // fprintf (stdout, "Options:\n"); + fprintf (stdout, " --uefi\n\ + Enable UefiCompress, use TianoCompress when without this option\n"); fprintf (stdout, " -o FileName, --output FileName\n\ File will be created to store the ouput content.\n"); fprintf (stdout, " -v, --verbose\n\ @@ -1822,6 +1826,13 @@ Returns: continue; } + if (stricmp(argv[0], "--uefi") == 0) { + UEFIMODE = TRUE; + argc--; + argv++; + continue; + } + if (stricmp (argv[0], "--debug") == 0) { argc-=2; argv++; @@ -1939,8 +1950,12 @@ Returns: if (DebugMode) { DebugMsg(UTILITY_NAME, 0, DebugLevel, "Encoding", NULL); } - Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize); - + if (UEFIMODE) { + Status = EfiCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize); + } else { + Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize); + } + if (Status == EFI_BUFFER_TOO_SMALL) { OutBuffer = (UINT8 *) malloc (DstSize); if (OutBuffer == NULL) { @@ -1949,7 +1964,11 @@ Returns: } } - Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize); + if (UEFIMODE) { + Status = EfiCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize); + } else { + Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize); + } if (Status != EFI_SUCCESS) { Error (NULL, 0, 0007, "Error compressing file", NULL); goto ERROR; @@ -1979,32 +1998,46 @@ Returns: if (DebugMode) { DebugMsg(UTILITY_NAME, 0, DebugLevel, "Decoding\n", NULL); } - // - // Get Compressed file original size - // - Src = (UINT8 *)FileBuffer; - OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24); - - // - // Allocate OutputBuffer - // - OutBuffer = (UINT8 *)malloc(OrigSize); - if (OutBuffer == NULL) { - Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!"); - goto ERROR; - } - Status = Decompress((VOID *)FileBuffer, (VOID *)OutBuffer, (VOID *)Scratch, 2); - if (Status != EFI_SUCCESS) { - goto ERROR; + if (UEFIMODE) { + Status = Extract((VOID *)FileBuffer, InputLength, (VOID *)&OutBuffer, &DstSize, 1); + if (Status != EFI_SUCCESS) { + goto ERROR; + } + fwrite(OutBuffer, (size_t)(DstSize), 1, OutputFile); + } else { + // + // Get Compressed file original size + // + Src = (UINT8 *)FileBuffer; + OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24); + + // + // Allocate OutputBuffer + // + OutBuffer = (UINT8 *)malloc(OrigSize); + if (OutBuffer == NULL) { + Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!"); + goto ERROR; + } + + Status = TDecompress((VOID *)FileBuffer, (VOID *)OutBuffer, (VOID *)Scratch, 2); + if (Status != EFI_SUCCESS) { + goto ERROR; + } + fwrite(OutBuffer, (size_t)(Scratch->mOrigSize), 1, OutputFile); } - - fwrite(OutBuffer, (size_t)(Scratch->mOrigSize), 1, OutputFile); fclose(OutputFile); fclose(InputFile); - free(Scratch); - free(FileBuffer); - free(OutBuffer); + if (Scratch != NULL) { + free(Scratch); + } + if (FileBuffer != NULL) { + free(FileBuffer); + } + if (OutBuffer != NULL) { + free(OutBuffer); + } if (DebugMode) { DebugMsg(UTILITY_NAME, 0, DebugLevel, "Encoding successful!\n", NULL); @@ -2634,7 +2667,7 @@ Done: RETURN_STATUS EFIAPI -Decompress ( +TDecompress ( IN VOID *Source, IN OUT VOID *Destination, IN OUT VOID *Scratch, diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.h b/BaseTools/Source/C/TianoCompress/TianoCompress.h index 2971225d1b58..a5ec45a452bf 100644 --- a/BaseTools/Source/C/TianoCompress/TianoCompress.h +++ b/BaseTools/Source/C/TianoCompress/TianoCompress.h @@ -427,7 +427,7 @@ Decode ( RETURN_STATUS EFIAPI -Decompress ( +TDecompress ( IN VOID *Source, IN OUT VOID *Destination, IN OUT VOID *Scratch, -- 2.19.1 From bab2ccb60c52e118bcda54c542e680b6d8fe5e33 Mon Sep 17 00:00:00 2001 From: Liming Gao <liming.gao@intel.com> Date: Tue, 16 Oct 2018 10:06:13 +0800 Subject: [PATCH 4/7] BaseTools: Add more checker in Decompress algorithm to access the valid buffer (CVE FIX) Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735 https://bugzilla.tianocore.org/show_bug.cgi?id=686 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com> Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit 041d89bc0f0119df37a5fce1d0f16495ff905089) --- BaseTools/Source/C/Common/Decompress.c | 23 ++++++++++++++-- .../Source/C/TianoCompress/TianoCompress.c | 26 ++++++++++++++++++- 2 files changed, 46 insertions(+), 3 deletions(-) diff --git a/BaseTools/Source/C/Common/Decompress.c b/BaseTools/Source/C/Common/Decompress.c index b2049bd01c5f..a87e806961e8 100644 --- a/BaseTools/Source/C/Common/Decompress.c +++ b/BaseTools/Source/C/Common/Decompress.c @@ -194,12 +194,16 @@ Returns: UINT16 Avail; UINT16 NextCode; UINT16 Mask; + UINT16 MaxTableLength; for (Index = 1; Index <= 16; Index++) { Count[Index] = 0; } for (Index = 0; Index < NumOfChar; Index++) { + if (BitLen[Index] > 16) { + return (UINT16) BAD_TABLE; + } Count[BitLen[Index]]++; } @@ -237,6 +241,7 @@ Returns: Avail = NumOfChar; Mask = (UINT16) (1U << (15 - TableBits)); + MaxTableLength = (UINT16) (1U << TableBits); for (Char = 0; Char < NumOfChar; Char++) { @@ -250,6 +255,9 @@ Returns: if (Len <= TableBits) { for (Index = Start[Len]; Index < NextCode; Index++) { + if (Index >= MaxTableLength) { + return (UINT16) BAD_TABLE; + } Table[Index] = Char; } @@ -643,10 +651,14 @@ Returns: (VOID) BytesRemain--; while ((INT16) (BytesRemain) >= 0) { - Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++]; if (Sd->mOutBuf >= Sd->mOrigSize) { return ; } + if (DataIdx >= Sd->mOrigSize) { + Sd->mBadTableFlag = (UINT16) BAD_TABLE; + return ; + } + Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++]; BytesRemain--; } @@ -684,6 +696,7 @@ Returns: --*/ { UINT8 *Src; + UINT32 CompSize; *ScratchSize = sizeof (SCRATCH_DATA); @@ -692,7 +705,13 @@ Returns: return EFI_INVALID_PARAMETER; } + CompSize = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24); *DstSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24); + + if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) { + return EFI_INVALID_PARAMETER; + } + return EFI_SUCCESS; } @@ -752,7 +771,7 @@ Returns: CompSize = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24); OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24); - if (SrcSize < CompSize + 8) { + if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) { return EFI_INVALID_PARAMETER; } diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c index 4bd341e36d03..c6c89e3f7d36 100644 --- a/BaseTools/Source/C/TianoCompress/TianoCompress.c +++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c @@ -1757,6 +1757,7 @@ Returns: SCRATCH_DATA *Scratch; UINT8 *Src; UINT32 OrigSize; + UINT32 CompSize; SetUtilityName(UTILITY_NAME); @@ -1765,6 +1766,7 @@ Returns: OutBuffer = NULL; Scratch = NULL; OrigSize = 0; + CompSize = 0; InputLength = 0; InputFileName = NULL; OutputFileName = NULL; @@ -2006,15 +2008,24 @@ Returns: } fwrite(OutBuffer, (size_t)(DstSize), 1, OutputFile); } else { + if (InputLength < 8){ + Error (NULL, 0, 3000, "Invalid", "The input file %s is too small.", InputFileName); + goto ERROR; + } // // Get Compressed file original size // Src = (UINT8 *)FileBuffer; OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24); + CompSize = Src[0] + (Src[1] << 8) + (Src[2] <<16) + (Src[3] <<24); // // Allocate OutputBuffer // + if (InputLength < CompSize + 8 || (CompSize + 8) < 8) { + Error (NULL, 0, 3000, "Invalid", "The input file %s data is invalid.", InputFileName); + goto ERROR; + } OutBuffer = (UINT8 *)malloc(OrigSize); if (OutBuffer == NULL) { Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!"); @@ -2204,12 +2215,16 @@ Returns: UINT16 Mask; UINT16 WordOfStart; UINT16 WordOfCount; + UINT16 MaxTableLength; for (Index = 0; Index <= 16; Index++) { Count[Index] = 0; } for (Index = 0; Index < NumOfChar; Index++) { + if (BitLen[Index] > 16) { + return (UINT16) BAD_TABLE; + } Count[BitLen[Index]]++; } @@ -2253,6 +2268,7 @@ Returns: Avail = NumOfChar; Mask = (UINT16) (1U << (15 - TableBits)); + MaxTableLength = (UINT16) (1U << TableBits); for (Char = 0; Char < NumOfChar; Char++) { @@ -2266,6 +2282,9 @@ Returns: if (Len <= TableBits) { for (Index = Start[Len]; Index < NextCode; Index++) { + if (Index >= MaxTableLength) { + return (UINT16) BAD_TABLE; + } Table[Index] = Char; } @@ -2650,11 +2669,16 @@ Returns: (VOID) DataIdx = Sd->mOutBuf - DecodeP (Sd) - 1; BytesRemain--; + while ((INT16) (BytesRemain) >= 0) { - Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++]; if (Sd->mOutBuf >= Sd->mOrigSize) { goto Done ; } + if (DataIdx >= Sd->mOrigSize) { + Sd->mBadTableFlag = (UINT16) BAD_TABLE; + goto Done ; + } + Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++]; BytesRemain--; } -- 2.19.1 From 75226c93dbd1893d55f12ee6a8578694c28f8005 Mon Sep 17 00:00:00 2001 From: Liming Gao <liming.gao@intel.com> Date: Fri, 9 Nov 2018 07:58:14 +0800 Subject: [PATCH 5/7] BaseTools: Fix UEFI and Tiano Decompression logic issue https://bugzilla.tianocore.org/show_bug.cgi?id=1317 This is a regression issue caused by 041d89bc0f0119df37a5fce1d0f16495ff905089. In Decode() function, once mOutBuf is fully filled, Decode() should return. Current logic misses the checker of mOutBuf after while() loop. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Liming Gao <liming.gao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com> (cherry picked from commit 5e45a1fdcfbf9b2b389122eb97475148594625f8) --- BaseTools/Source/C/Common/Decompress.c | 6 ++++++ BaseTools/Source/C/TianoCompress/TianoCompress.c | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/BaseTools/Source/C/Common/Decompress.c b/BaseTools/Source/C/Common/Decompress.c index a87e806961e8..ed08545918b4 100644 --- a/BaseTools/Source/C/Common/Decompress.c +++ b/BaseTools/Source/C/Common/Decompress.c @@ -662,6 +662,12 @@ Returns: (VOID) BytesRemain--; } + // + // Once mOutBuf is fully filled, directly return + // + if (Sd->mOutBuf >= Sd->mOrigSize) { + return ; + } } } diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c index c6c89e3f7d36..c6053e79738d 100644 --- a/BaseTools/Source/C/TianoCompress/TianoCompress.c +++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c @@ -2682,6 +2682,12 @@ Returns: (VOID) BytesRemain--; } + // + // Once mOutBuf is fully filled, directly return + // + if (Sd->mOutBuf >= Sd->mOrigSize) { + goto Done ; + } } } -- 2.19.1 From d8373748447f344bf4ca6ed46421dea4643570a0 Mon Sep 17 00:00:00 2001 From: Liming Gao <liming.gao@intel.com> Date: Fri, 9 Nov 2018 07:58:15 +0800 Subject: [PATCH 6/7] MdePkg BaseUefiDecompressLib: Fix UEFI Decompression logic issue https://bugzilla.tianocore.org/show_bug.cgi?id=1317 This is a regression issue caused by 2ec7953d49677142c5f7552e9e3d96fb406ba0c4. In Decode() function, once mOutBuf is fully filled, Decode() should return. Current logic misses the checker of mOutBuf after while() loop. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Liming Gao <liming.gao@intel.com> Cc: Michael Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com> (cherry picked from commit 1c4cecc9fd314de0dce8125b0d4b45967637a401) --- .../Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c index 0c6b1fe4ee83..8c30e971f95b 100644 --- a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c +++ b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c @@ -641,6 +641,12 @@ Decode ( BytesRemain--; } + // + // Once mOutBuf is fully filled, directly return + // + if (Sd->mOutBuf >= Sd->mOrigSize) { + goto Done; + } } } -- 2.19.1 From 3541b6fb4d73a1f50be4788b5f14fb0e4e2f7f24 Mon Sep 17 00:00:00 2001 From: Liming Gao <liming.gao@intel.com> Date: Fri, 9 Nov 2018 07:58:16 +0800 Subject: [PATCH 7/7] IntelFrameworkModulePkg: Fix UEFI and Tiano Decompression logic issue https://bugzilla.tianocore.org/show_bug.cgi?id=1317 This is a regression issue caused by 684db6da64bc7b5faee4e1174e801c245f563b5c. In Decode() function, once mOutBuf is fully filled, Decode() should return. Current logic misses the checker of mOutBuf after while() loop. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com> (cherry picked from commit ade71c52a49d659b20c0b433fb11ddb4f4f543c4) --- .../BaseUefiTianoCustomDecompressLib.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c index 9b001667ef7e..e34bf4bd40c5 100644 --- a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c +++ b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c @@ -634,6 +634,12 @@ Decode ( BytesRemain--; } + // + // Once mOutBuf is fully filled, directly return + // + if (Sd->mOutBuf >= Sd->mOrigSize) { + goto Done ; + } } } -- 2.19.1
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
