File ovmf.1c47ab04046d8a4123d4bcf8826f42aca2777292.p... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File ovmf.1c47ab04046d8a4123d4bcf8826f42aca2777292.patch of Package xen (Revision 4208e3285bbdc9d20c0d1eef8bbf33b9)

Currently displaying revision 4208e3285bbdc9d20c0d1eef8bbf33b9 , Show latest

From: Hao Wu <hao.a.wu@intel.com>
Date: Mon, 18 Dec 2017 09:19:23 +0800
Subject: 1c47ab04046d8a4123d4bcf8826f42aca2777292

BaseTools/GenVtf: Add/refine boundary checks for strcpy/strcat calls

Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.

Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
---
 BaseTools/Source/C/GenVtf/GenVtf.c | 43 +++++++++++++++++++++++++++++++++++++------
 1 file changed, 37 insertions(+), 6 deletions(-)

--- a/BaseTools/Source/C/GenVtf/GenVtf.c
+++ b/BaseTools/Source/C/GenVtf/GenVtf.c
@@ -353,28 +353,38 @@ Returns:
     } else if (strnicmp (*TokenStr, "COMP_VER", 8) == 0) {
       TokenStr++;
       if (strnicmp (*TokenStr, "-", 1) == 0) {
         VtfInfo->VersionPresent = FALSE;
         VtfInfo->MajorVer       = 0;
         VtfInfo->MinorVer       = 0;
       } else {
         VtfInfo->VersionPresent = TRUE;
         ConvertVersionInfo (*TokenStr, &VtfInfo->MajorVer, &VtfInfo->MinorVer);
       }
     } else if (strnicmp (*TokenStr, "COMP_BIN", 8) == 0) {
       TokenStr++;
-      strcpy (VtfInfo->CompBinName, *TokenStr);
+      if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+        Error (NULL, 0, 3000, "Invalid", "The 'COMP_BIN' name is too long.");
+        return ;
+      }
+      strncpy (VtfInfo->CompBinName, *TokenStr, FILE_NAME_SIZE - 1);
+      VtfInfo->CompBinName[FILE_NAME_SIZE - 1] = 0;
     } else if (strnicmp (*TokenStr, "COMP_SYM", 8) == 0) {
       TokenStr++;
-      strcpy (VtfInfo->CompSymName, *TokenStr);
+      if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+        Error (NULL, 0, 3000, "Invalid", "The 'COMP_SYM' name is too long.");
+        return ;
+      }
+      strncpy (VtfInfo->CompSymName, *TokenStr, FILE_NAME_SIZE - 1);
+      VtfInfo->CompSymName[FILE_NAME_SIZE - 1] = 0;
     } else if (strnicmp (*TokenStr, "COMP_SIZE", 9) == 0) {
       TokenStr++;
       if (strnicmp (*TokenStr, "-", 1) == 0) {
         VtfInfo->PreferredSize  = FALSE;
         VtfInfo->CompSize       = 0;
       } else {
         VtfInfo->PreferredSize = TRUE;
         if (AsciiStringToUint64 (*TokenStr, FALSE, &StringValue) != EFI_SUCCESS) {
           Error (NULL, 0, 5001, "Parse error", "Cannot get: %s.", TokenStr);
           return ;
         }
 
@@ -435,32 +445,42 @@ Returns:
       if (FileListPtr == NULL) {
         FileListPtr = FileListHeadPtr;
       }
 
       SectionCompFlag   = 1;
       SectionOptionFlag = 0;
       TokenStr++;
     }
 
     if (SectionOptionFlag) {
       if (stricmp (*TokenStr, "IA32_RST_BIN") == 0) {
         TokenStr++;
-        strcpy (IA32BinFile, *TokenStr);
+        if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+          Error (NULL, 0, 3000, "Invalid", "The 'IA32_RST_BIN' name is too long.");
+          break;
+        }
+        strncpy (IA32BinFile, *TokenStr, FILE_NAME_SIZE - 1);
+        IA32BinFile[FILE_NAME_SIZE - 1] = 0;
       }
     }
 
     if (SectionCompFlag) {
       if (stricmp (*TokenStr, "COMP_NAME") == 0) {
         TokenStr++;
-        strcpy (FileListPtr->CompName, *TokenStr);
+        if (strlen (*TokenStr) >= COMPONENT_NAME_SIZE) {
+          Error (NULL, 0, 3000, "Invalid", "The 'COMP_NAME' name is too long.");
+          break;
+        }
+        strncpy (FileListPtr->CompName, *TokenStr, COMPONENT_NAME_SIZE - 1);
+        FileListPtr->CompName[COMPONENT_NAME_SIZE - 1] = 0;
         TokenStr++;
         ParseAndUpdateComponents (FileListPtr);
       }
 
       if (*TokenStr != NULL) {
         FileListPtr->NextVtfInfo  = malloc (sizeof (PARSED_VTF_INFO));
         if (FileListPtr->NextVtfInfo == NULL) {
           Error (NULL, 0, 4003, "Resource", "Out of memory resources.", NULL);
           break;
         }
         FileListPtr = FileListPtr->NextVtfInfo;
         memset (FileListPtr, 0, sizeof (PARSED_VTF_INFO));
@@ -2231,27 +2251,38 @@ Returns:
   SourceFile = fopen (LongFilePath (SourceFileName), "r");
   if (SourceFile == NULL) {
 
     //
     // SYM files are not required.
     //
     return EFI_SUCCESS;
   }
 
   //
   // Use the file name minus extension as the base for tokens
   //
-  strcpy (BaseToken, SourceFileName);
+  if (strlen (SourceFileName) >= MAX_LONG_FILE_PATH) {
+    fclose (SourceFile);
+    Error (NULL, 0, 2000, "Invalid parameter", "The source file name is too long.");
+    return EFI_ABORTED;
+  }
+  strncpy (BaseToken, SourceFileName, MAX_LONG_FILE_PATH - 1);
+  BaseToken[MAX_LONG_FILE_PATH - 1] = 0;
   strtok (BaseToken, ". \t\n");
-  strcat (BaseToken, "__");
+  if (strlen (BaseToken) + strlen ("__") >= MAX_LONG_FILE_PATH) {
+    fclose (SourceFile);
+    Error (NULL, 0, 2000, "Invalid parameter", "The source file name is too long.");
+    return EFI_ABORTED;
+  }
+  strncat (BaseToken, "__", MAX_LONG_FILE_PATH - strlen (BaseToken) - 1);
 
   //
   // Open the destination file
   //
   DestFile = fopen (LongFilePath (DestFileName), "a+");
   if (DestFile == NULL) {
     fclose (SourceFile);
     Error (NULL, 0, 0001, "Error opening file", DestFileName);
     return EFI_ABORTED;
   }
 
   //

Places

File ovmf.1c47ab04046d8a4123d4bcf8826f42aca2777292.patch of Package xen (Revision 4208e3285bbdc9d20c0d1eef8bbf33b9)

Places