RH covscan justifiedly reports that accessing
"EFI_COMMON_SECTION_HEADER.Size", which is of type UINT8[3], through a
(UINT32*), is undefined behavior:
> Error: OVERRUN (CWE-119):
> edk2-89910a39dcfd/OvmfPkg/Sec/SecMain.c:178: overrun-local: Overrunning
> array of 3 bytes at byte offset 3 by dereferencing pointer
> "(UINT32 *)((EFI_COMMON_SECTION_HEADER *)(UINTN)Section)->Size".
> # 176| Section = (EFI_COMMON_SECTION_HEADER*)(UINTN) CurrentAddress;
> # 177|
> # 178|-> Size = SECTION_SIZE (Section);
> # 179| if (Size < sizeof (*Section)) {
> # 180| return EFI_VOLUME_CORRUPTED;
Fix this by accessing the array elements individually.
Cc: Liming Gao <liming....@intel.com>
Cc: Michael D Kinney <michael.d.kin...@intel.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1710
Issue: scan-1007.txt
Signed-off-by: Laszlo Ersek <ler...@redhat.com>
---
Notes:
v2:
- replace EFI_COMMON_SECTION_HEADER_UNION with individual array element
access [Jordan, Phil, Mike]
MdePkg/Include/Pi/PiFirmwareFile.h | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/MdePkg/Include/Pi/PiFirmwareFile.h
b/MdePkg/Include/Pi/PiFirmwareFile.h
index a9f3bcc4eb8e..05470538de42 100644
--- a/MdePkg/Include/Pi/PiFirmwareFile.h
+++ b/MdePkg/Include/Pi/PiFirmwareFile.h
@@ -480,8 +480,15 @@ typedef struct {
CHAR16 VersionString[1];
} EFI_VERSION_SECTION2;
-#define SECTION_SIZE(SectionHeaderPtr) \
- ((UINT32) (*((UINT32 *) ((EFI_COMMON_SECTION_HEADER *) (UINTN)
SectionHeaderPtr)->Size) & 0x00ffffff))
+///
+/// The argument passed as the SectionHeaderPtr parameter to the SECTION_SIZE()
+/// and IS_SECTION2() function-like macros below must not have side effects:
+/// SectionHeaderPtr is evaluated multiple times.
+///
+#define SECTION_SIZE(SectionHeaderPtr) ((UINT32) ( \
+ (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[0]
) | \
+ (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[1] <<
8) | \
+ (((EFI_COMMON_SECTION_HEADER *) (UINTN) (SectionHeaderPtr))->Size[2] <<
16)))
#define IS_SECTION2(SectionHeaderPtr) \
(SECTION_SIZE (SectionHeaderPtr) == 0x00ffffff)
--
2.19.1.3.g30247aa5d201
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#39308): https://edk2.groups.io/g/devel/message/39308
Mute This Topic: https://groups.io/mt/31233850/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
