File ovmf-bsc1115917-bounds-checking-for-ueficompress.patch of Package ovmf.16349
From 2c959247bf82755fd38a5001238e6f0ccd6cf07f Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Tue, 16 Oct 2018 10:06:11 +0800
Subject: [PATCH 1/7] MdePkg: Add more checker in UefiDecompressLib to access
the valid buffer only (CVE FIX)
Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735
https://bugzilla.tianocore.org/show_bug.cgi?id=686
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com>
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 2ec7953d49677142c5f7552e9e3d96fb406ba0c4)
---
.../BaseUefiDecompressLib.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
index e818543d9255..0c6b1fe4ee83 100644
--- a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
+++ b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
@@ -152,6 +152,7 @@ MakeTable (
UINT16 Mask;
UINT16 WordOfStart;
UINT16 WordOfCount;
+ UINT16 MaxTableLength;
//
// The maximum mapping table width supported by this internal
@@ -164,6 +165,9 @@ MakeTable (
}
for (Index = 0; Index < NumOfChar; Index++) {
+ if (BitLen[Index] > 16) {
+ return (UINT16) BAD_TABLE;
+ }
Count[BitLen[Index]]++;
}
@@ -205,6 +209,7 @@ MakeTable (
Avail = NumOfChar;
Mask = (UINT16) (1U << (15 - TableBits));
+ MaxTableLength = (UINT16) (1U << TableBits);
for (Char = 0; Char < NumOfChar; Char++) {
@@ -218,6 +223,9 @@ MakeTable (
if (Len <= TableBits) {
for (Index = Start[Len]; Index < NextCode; Index++) {
+ if (Index >= MaxTableLength) {
+ return (UINT16) BAD_TABLE;
+ }
Table[Index] = Char;
}
@@ -620,11 +628,16 @@ Decode (
// Write BytesRemain of bytes into mDstBase
//
BytesRemain--;
+
while ((INT16) (BytesRemain) >= 0) {
- Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
if (Sd->mOutBuf >= Sd->mOrigSize) {
goto Done;
}
+ if (DataIdx >= Sd->mOrigSize) {
+ Sd->mBadTableFlag = (UINT16) BAD_TABLE;
+ goto Done;
+ }
+ Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
BytesRemain--;
}
@@ -694,7 +707,7 @@ UefiDecompressGetInfo (
}
CompressedSize = ReadUnaligned32 ((UINT32 *)Source);
- if (SourceSize < (CompressedSize + 8)) {
+ if (SourceSize < (CompressedSize + 8) || (CompressedSize + 8) < 8) {
return RETURN_INVALID_PARAMETER;
}
--
2.19.1
From 7c0b8f75fc6bcb0e10a5b55f1ba73d764752202a Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Tue, 16 Oct 2018 10:06:12 +0800
Subject: [PATCH 2/7] IntelFrameworkModulePkg: Add more checker in
UefiTianoDecompressLib (CVE FIX)
Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735
https://bugzilla.tianocore.org/show_bug.cgi?id=686
To make sure the valid buffer be accessed only.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com>
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 684db6da64bc7b5faee4e1174e801c245f563b5c)
---
.../BaseUefiTianoCustomDecompressLib.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
index cb009e7771bb..9b001667ef7e 100644
--- a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
+++ b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
@@ -143,6 +143,7 @@ MakeTable (
UINT16 Mask;
UINT16 WordOfStart;
UINT16 WordOfCount;
+ UINT16 MaxTableLength;
//
// The maximum mapping table width supported by this internal
@@ -155,6 +156,9 @@ MakeTable (
}
for (Index = 0; Index < NumOfChar; Index++) {
+ if (BitLen[Index] > 16) {
+ return (UINT16) BAD_TABLE;
+ }
Count[BitLen[Index]]++;
}
@@ -196,6 +200,7 @@ MakeTable (
Avail = NumOfChar;
Mask = (UINT16) (1U << (15 - TableBits));
+ MaxTableLength = (UINT16) (1U << TableBits);
for (Char = 0; Char < NumOfChar; Char++) {
@@ -209,6 +214,9 @@ MakeTable (
if (Len <= TableBits) {
for (Index = Start[Len]; Index < NextCode; Index++) {
+ if (Index >= MaxTableLength) {
+ return (UINT16) BAD_TABLE;
+ }
Table[Index] = Char;
}
@@ -615,10 +623,14 @@ Decode (
//
BytesRemain--;
while ((INT16) (BytesRemain) >= 0) {
- Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
if (Sd->mOutBuf >= Sd->mOrigSize) {
goto Done ;
}
+ if (DataIdx >= Sd->mOrigSize) {
+ Sd->mBadTableFlag = (UINT16) BAD_TABLE;
+ goto Done ;
+ }
+ Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
BytesRemain--;
}
@@ -688,7 +700,7 @@ UefiDecompressGetInfo (
}
CompressedSize = ReadUnaligned32 ((UINT32 *)Source);
- if (SourceSize < (CompressedSize + 8)) {
+ if (SourceSize < (CompressedSize + 8) || (CompressedSize + 8) < 8) {
return RETURN_INVALID_PARAMETER;
}
--
2.19.1
From 997784f1a89fbee08cacf5efbcb3ff380dac2c33 Mon Sep 17 00:00:00 2001
From: Yunhua Feng <yunhuax.feng@intel.com>
Date: Sun, 30 Sep 2018 11:07:18 +0800
Subject: [PATCH 3/7] BaseTools: Add --uefi option to enable UefiCompress
method
Add one new option --uefi to enable UefiCompress.
(re-add this patch since it be reverted in Python3 migration patches,
but this patch is not related with Python3)
Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yunhua Feng <yunhuax.feng@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit f1400101a732ee2e7e0f6d53712caec77ff695f9)
---
.../Source/C/TianoCompress/TianoCompress.c | 85 +++++++++++++------
.../Source/C/TianoCompress/TianoCompress.h | 2 +-
2 files changed, 60 insertions(+), 27 deletions(-)
diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c
index 046fb36a178d..4bd341e36d03 100644
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.c
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c
@@ -17,6 +17,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
#include "Compress.h"
+#include "Decompress.h"
#include "TianoCompress.h"
#include "EfiUtilityMsgs.h"
#include "ParseInf.h"
@@ -65,6 +66,7 @@ static BOOLEAN QuietMode = FALSE;
//
STATIC BOOLEAN ENCODE = FALSE;
STATIC BOOLEAN DECODE = FALSE;
+STATIC BOOLEAN UEFIMODE = FALSE;
STATIC UINT8 *mSrc, *mDst, *mSrcUpperLimit, *mDstUpperLimit;
STATIC UINT8 *mLevel, *mText, *mChildCount, *mBuf, mCLen[NC], mPTLen[NPT], *mLen;
STATIC INT16 mHeap[NC + 1];
@@ -1703,6 +1705,8 @@ Returns:
// Details Option
//
fprintf (stdout, "Options:\n");
+ fprintf (stdout, " --uefi\n\
+ Enable UefiCompress, use TianoCompress when without this option\n");
fprintf (stdout, " -o FileName, --output FileName\n\
File will be created to store the ouput content.\n");
fprintf (stdout, " -v, --verbose\n\
@@ -1822,6 +1826,13 @@ Returns:
continue;
}
+ if (stricmp(argv[0], "--uefi") == 0) {
+ UEFIMODE = TRUE;
+ argc--;
+ argv++;
+ continue;
+ }
+
if (stricmp (argv[0], "--debug") == 0) {
argc-=2;
argv++;
@@ -1939,8 +1950,12 @@ Returns:
if (DebugMode) {
DebugMsg(UTILITY_NAME, 0, DebugLevel, "Encoding", NULL);
}
- Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
-
+ if (UEFIMODE) {
+ Status = EfiCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+ } else {
+ Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+ }
+
if (Status == EFI_BUFFER_TOO_SMALL) {
OutBuffer = (UINT8 *) malloc (DstSize);
if (OutBuffer == NULL) {
@@ -1949,7 +1964,11 @@ Returns:
}
}
- Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+ if (UEFIMODE) {
+ Status = EfiCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+ } else {
+ Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+ }
if (Status != EFI_SUCCESS) {
Error (NULL, 0, 0007, "Error compressing file", NULL);
goto ERROR;
@@ -1979,32 +1998,46 @@ Returns:
if (DebugMode) {
DebugMsg(UTILITY_NAME, 0, DebugLevel, "Decoding\n", NULL);
}
- //
- // Get Compressed file original size
- //
- Src = (UINT8 *)FileBuffer;
- OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
-
- //
- // Allocate OutputBuffer
- //
- OutBuffer = (UINT8 *)malloc(OrigSize);
- if (OutBuffer == NULL) {
- Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!");
- goto ERROR;
- }
- Status = Decompress((VOID *)FileBuffer, (VOID *)OutBuffer, (VOID *)Scratch, 2);
- if (Status != EFI_SUCCESS) {
- goto ERROR;
+ if (UEFIMODE) {
+ Status = Extract((VOID *)FileBuffer, InputLength, (VOID *)&OutBuffer, &DstSize, 1);
+ if (Status != EFI_SUCCESS) {
+ goto ERROR;
+ }
+ fwrite(OutBuffer, (size_t)(DstSize), 1, OutputFile);
+ } else {
+ //
+ // Get Compressed file original size
+ //
+ Src = (UINT8 *)FileBuffer;
+ OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
+
+ //
+ // Allocate OutputBuffer
+ //
+ OutBuffer = (UINT8 *)malloc(OrigSize);
+ if (OutBuffer == NULL) {
+ Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!");
+ goto ERROR;
+ }
+
+ Status = TDecompress((VOID *)FileBuffer, (VOID *)OutBuffer, (VOID *)Scratch, 2);
+ if (Status != EFI_SUCCESS) {
+ goto ERROR;
+ }
+ fwrite(OutBuffer, (size_t)(Scratch->mOrigSize), 1, OutputFile);
}
-
- fwrite(OutBuffer, (size_t)(Scratch->mOrigSize), 1, OutputFile);
fclose(OutputFile);
fclose(InputFile);
- free(Scratch);
- free(FileBuffer);
- free(OutBuffer);
+ if (Scratch != NULL) {
+ free(Scratch);
+ }
+ if (FileBuffer != NULL) {
+ free(FileBuffer);
+ }
+ if (OutBuffer != NULL) {
+ free(OutBuffer);
+ }
if (DebugMode) {
DebugMsg(UTILITY_NAME, 0, DebugLevel, "Encoding successful!\n", NULL);
@@ -2634,7 +2667,7 @@ Done:
RETURN_STATUS
EFIAPI
-Decompress (
+TDecompress (
IN VOID *Source,
IN OUT VOID *Destination,
IN OUT VOID *Scratch,
diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.h b/BaseTools/Source/C/TianoCompress/TianoCompress.h
index 2971225d1b58..a5ec45a452bf 100644
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.h
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.h
@@ -427,7 +427,7 @@ Decode (
RETURN_STATUS
EFIAPI
-Decompress (
+TDecompress (
IN VOID *Source,
IN OUT VOID *Destination,
IN OUT VOID *Scratch,
--
2.19.1
From bab2ccb60c52e118bcda54c542e680b6d8fe5e33 Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Tue, 16 Oct 2018 10:06:13 +0800
Subject: [PATCH 4/7] BaseTools: Add more checker in Decompress algorithm to
access the valid buffer (CVE FIX)
Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735
https://bugzilla.tianocore.org/show_bug.cgi?id=686
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com>
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 041d89bc0f0119df37a5fce1d0f16495ff905089)
---
BaseTools/Source/C/Common/Decompress.c | 23 ++++++++++++++--
.../Source/C/TianoCompress/TianoCompress.c | 26 ++++++++++++++++++-
2 files changed, 46 insertions(+), 3 deletions(-)
diff --git a/BaseTools/Source/C/Common/Decompress.c b/BaseTools/Source/C/Common/Decompress.c
index b2049bd01c5f..a87e806961e8 100644
--- a/BaseTools/Source/C/Common/Decompress.c
+++ b/BaseTools/Source/C/Common/Decompress.c
@@ -194,12 +194,16 @@ Returns:
UINT16 Avail;
UINT16 NextCode;
UINT16 Mask;
+ UINT16 MaxTableLength;
for (Index = 1; Index <= 16; Index++) {
Count[Index] = 0;
}
for (Index = 0; Index < NumOfChar; Index++) {
+ if (BitLen[Index] > 16) {
+ return (UINT16) BAD_TABLE;
+ }
Count[BitLen[Index]]++;
}
@@ -237,6 +241,7 @@ Returns:
Avail = NumOfChar;
Mask = (UINT16) (1U << (15 - TableBits));
+ MaxTableLength = (UINT16) (1U << TableBits);
for (Char = 0; Char < NumOfChar; Char++) {
@@ -250,6 +255,9 @@ Returns:
if (Len <= TableBits) {
for (Index = Start[Len]; Index < NextCode; Index++) {
+ if (Index >= MaxTableLength) {
+ return (UINT16) BAD_TABLE;
+ }
Table[Index] = Char;
}
@@ -643,10 +651,14 @@ Returns: (VOID)
BytesRemain--;
while ((INT16) (BytesRemain) >= 0) {
- Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
if (Sd->mOutBuf >= Sd->mOrigSize) {
return ;
}
+ if (DataIdx >= Sd->mOrigSize) {
+ Sd->mBadTableFlag = (UINT16) BAD_TABLE;
+ return ;
+ }
+ Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
BytesRemain--;
}
@@ -684,6 +696,7 @@ Returns:
--*/
{
UINT8 *Src;
+ UINT32 CompSize;
*ScratchSize = sizeof (SCRATCH_DATA);
@@ -692,7 +705,13 @@ Returns:
return EFI_INVALID_PARAMETER;
}
+ CompSize = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24);
*DstSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
+
+ if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) {
+ return EFI_INVALID_PARAMETER;
+ }
+
return EFI_SUCCESS;
}
@@ -752,7 +771,7 @@ Returns:
CompSize = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24);
OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
- if (SrcSize < CompSize + 8) {
+ if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) {
return EFI_INVALID_PARAMETER;
}
diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c
index 4bd341e36d03..c6c89e3f7d36 100644
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.c
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c
@@ -1757,6 +1757,7 @@ Returns:
SCRATCH_DATA *Scratch;
UINT8 *Src;
UINT32 OrigSize;
+ UINT32 CompSize;
SetUtilityName(UTILITY_NAME);
@@ -1765,6 +1766,7 @@ Returns:
OutBuffer = NULL;
Scratch = NULL;
OrigSize = 0;
+ CompSize = 0;
InputLength = 0;
InputFileName = NULL;
OutputFileName = NULL;
@@ -2006,15 +2008,24 @@ Returns:
}
fwrite(OutBuffer, (size_t)(DstSize), 1, OutputFile);
} else {
+ if (InputLength < 8){
+ Error (NULL, 0, 3000, "Invalid", "The input file %s is too small.", InputFileName);
+ goto ERROR;
+ }
//
// Get Compressed file original size
//
Src = (UINT8 *)FileBuffer;
OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
+ CompSize = Src[0] + (Src[1] << 8) + (Src[2] <<16) + (Src[3] <<24);
//
// Allocate OutputBuffer
//
+ if (InputLength < CompSize + 8 || (CompSize + 8) < 8) {
+ Error (NULL, 0, 3000, "Invalid", "The input file %s data is invalid.", InputFileName);
+ goto ERROR;
+ }
OutBuffer = (UINT8 *)malloc(OrigSize);
if (OutBuffer == NULL) {
Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!");
@@ -2204,12 +2215,16 @@ Returns:
UINT16 Mask;
UINT16 WordOfStart;
UINT16 WordOfCount;
+ UINT16 MaxTableLength;
for (Index = 0; Index <= 16; Index++) {
Count[Index] = 0;
}
for (Index = 0; Index < NumOfChar; Index++) {
+ if (BitLen[Index] > 16) {
+ return (UINT16) BAD_TABLE;
+ }
Count[BitLen[Index]]++;
}
@@ -2253,6 +2268,7 @@ Returns:
Avail = NumOfChar;
Mask = (UINT16) (1U << (15 - TableBits));
+ MaxTableLength = (UINT16) (1U << TableBits);
for (Char = 0; Char < NumOfChar; Char++) {
@@ -2266,6 +2282,9 @@ Returns:
if (Len <= TableBits) {
for (Index = Start[Len]; Index < NextCode; Index++) {
+ if (Index >= MaxTableLength) {
+ return (UINT16) BAD_TABLE;
+ }
Table[Index] = Char;
}
@@ -2650,11 +2669,16 @@ Returns: (VOID)
DataIdx = Sd->mOutBuf - DecodeP (Sd) - 1;
BytesRemain--;
+
while ((INT16) (BytesRemain) >= 0) {
- Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
if (Sd->mOutBuf >= Sd->mOrigSize) {
goto Done ;
}
+ if (DataIdx >= Sd->mOrigSize) {
+ Sd->mBadTableFlag = (UINT16) BAD_TABLE;
+ goto Done ;
+ }
+ Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
BytesRemain--;
}
--
2.19.1
From 75226c93dbd1893d55f12ee6a8578694c28f8005 Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Fri, 9 Nov 2018 07:58:14 +0800
Subject: [PATCH 5/7] BaseTools: Fix UEFI and Tiano Decompression logic issue
https://bugzilla.tianocore.org/show_bug.cgi?id=1317
This is a regression issue caused by 041d89bc0f0119df37a5fce1d0f16495ff905089.
In Decode() function, once mOutBuf is fully filled, Decode() should return.
Current logic misses the checker of mOutBuf after while() loop.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit 5e45a1fdcfbf9b2b389122eb97475148594625f8)
---
BaseTools/Source/C/Common/Decompress.c | 6 ++++++
BaseTools/Source/C/TianoCompress/TianoCompress.c | 6 ++++++
2 files changed, 12 insertions(+)
diff --git a/BaseTools/Source/C/Common/Decompress.c b/BaseTools/Source/C/Common/Decompress.c
index a87e806961e8..ed08545918b4 100644
--- a/BaseTools/Source/C/Common/Decompress.c
+++ b/BaseTools/Source/C/Common/Decompress.c
@@ -662,6 +662,12 @@ Returns: (VOID)
BytesRemain--;
}
+ //
+ // Once mOutBuf is fully filled, directly return
+ //
+ if (Sd->mOutBuf >= Sd->mOrigSize) {
+ return ;
+ }
}
}
diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c
index c6c89e3f7d36..c6053e79738d 100644
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.c
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c
@@ -2682,6 +2682,12 @@ Returns: (VOID)
BytesRemain--;
}
+ //
+ // Once mOutBuf is fully filled, directly return
+ //
+ if (Sd->mOutBuf >= Sd->mOrigSize) {
+ goto Done ;
+ }
}
}
--
2.19.1
From d8373748447f344bf4ca6ed46421dea4643570a0 Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Fri, 9 Nov 2018 07:58:15 +0800
Subject: [PATCH 6/7] MdePkg BaseUefiDecompressLib: Fix UEFI Decompression
logic issue
https://bugzilla.tianocore.org/show_bug.cgi?id=1317
This is a regression issue caused by 2ec7953d49677142c5f7552e9e3d96fb406ba0c4.
In Decode() function, once mOutBuf is fully filled, Decode() should return.
Current logic misses the checker of mOutBuf after while() loop.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Liming Gao <liming.gao@intel.com>
Cc: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit 1c4cecc9fd314de0dce8125b0d4b45967637a401)
---
.../Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
index 0c6b1fe4ee83..8c30e971f95b 100644
--- a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
+++ b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
@@ -641,6 +641,12 @@ Decode (
BytesRemain--;
}
+ //
+ // Once mOutBuf is fully filled, directly return
+ //
+ if (Sd->mOutBuf >= Sd->mOrigSize) {
+ goto Done;
+ }
}
}
--
2.19.1
From 3541b6fb4d73a1f50be4788b5f14fb0e4e2f7f24 Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Fri, 9 Nov 2018 07:58:16 +0800
Subject: [PATCH 7/7] IntelFrameworkModulePkg: Fix UEFI and Tiano Decompression
logic issue
https://bugzilla.tianocore.org/show_bug.cgi?id=1317
This is a regression issue caused by 684db6da64bc7b5faee4e1174e801c245f563b5c.
In Decode() function, once mOutBuf is fully filled, Decode() should return.
Current logic misses the checker of mOutBuf after while() loop.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit ade71c52a49d659b20c0b433fb11ddb4f4f543c4)
---
.../BaseUefiTianoCustomDecompressLib.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
index 9b001667ef7e..e34bf4bd40c5 100644
--- a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
+++ b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
@@ -634,6 +634,12 @@ Decode (
BytesRemain--;
}
+ //
+ // Once mOutBuf is fully filled, directly return
+ //
+ if (Sd->mOutBuf >= Sd->mOrigSize) {
+ goto Done ;
+ }
}
}
--
2.19.1
