Hi Laszlo, On 9/1/20 11:12 AM, Laszlo Ersek wrote: > The DxeImageVerificationHandler() function currently checks whether > "SecDataDir" has enough room for "WinCertificate->dwLength". However, for > advancing "OffSet", "WinCertificate->dwLength" is aligned to the next > multiple of 8. If "WinCertificate->dwLength" is large enough, the > alignment will return 0, and "OffSet" will be stuck at the same value. > > Check whether "SecDataDir" has room left for both > "WinCertificate->dwLength" and the alignment. > > Cc: Jian J Wang <jian.j.w...@intel.com> > Cc: Jiewen Yao <jiewen....@intel.com> > Cc: Min Xu <min.m...@intel.com> > Cc: Wenyi Xie <xiewen...@huawei.com> > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2215 > Signed-off-by: Laszlo Ersek <ler...@redhat.com> > --- > SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 4 > +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git > a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c > b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c > index 100739eb3eb6..11154b6cc58a 100644 > --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c > +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c > @@ -1860,7 +1860,9 @@ DxeImageVerificationHandler ( > break; > } > WinCertificate = (WIN_CERTIFICATE *) (mImageBase + OffSet); > - if (SecDataDirLeft < WinCertificate->dwLength) { > + if (SecDataDirLeft < WinCertificate->dwLength || > + (SecDataDirLeft - WinCertificate->dwLength < > + ALIGN_SIZE (WinCertificate->dwLength))) {
I dare to ask (probably again, I remember some similar boundary check style question once), why not as (which is simpler for me to review): if (SecDataDirLeft < WinCertificate->dwLength + ALIGN_SIZE (WinCertificate->dwLength)) { At any rate, for this patch: Reviewed-by: Philippe Mathieu-Daude <phi...@redhat.com> > break; > } > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64907): https://edk2.groups.io/g/devel/message/64907 Mute This Topic: https://groups.io/mt/76552541/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-