From nobody Mon May 6 09:50:36 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 149196195902269.32886558351663; Tue, 11 Apr 2017 18:52:39 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 045AE20D7648C; Tue, 11 Apr 2017 18:52:36 -0700 (PDT) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id EEF9F21DFA7AF for ; Tue, 11 Apr 2017 18:52:33 -0700 (PDT) Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Apr 2017 18:52:33 -0700 Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by fmsmga001.fm.intel.com with ESMTP; 11 Apr 2017 18:52:32 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.37,187,1488873600"; d="scan'208";a="1134232234" From: Hao Wu To: edk2-devel@lists.01.org, guoheyi@huawei.com Date: Wed, 12 Apr 2017 09:52:24 +0800 Message-Id: <20170412015228.20328-2-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170412015228.20328-1-hao.a.wu@intel.com> References: <20170412015228.20328-1-hao.a.wu@intel.com> Subject: [edk2] [PATCH v3 1/5] MdeModulePkg/ScsiDiskDxe: Fix undefined behavior in signed left shift X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hao Wu MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" In function GetMediaInfo(), the following expression: ScsiDiskDevice->BlkIo.Media->LastBlock =3D (Capacity10->LastLba3 << 24) | (Capacity10->LastLba2 << 16) | (Capacity10->LastLba1 << 8) | Capacity10->LastLba0; will involve undefined behavior in signed left shift operations. Since Capacity10->LastLbaX is of type UINT8, and ScsiDiskDevice->BlkIo.Media->LastBlock is of type UINT64. Therefore, Capacity10->LastLbaX will be promoted to int (32 bits, signed) first, and then perform the left shift operation. According to the C11 spec, Section 6.5.7: 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has an unsigned type, the value of the result is E1 * 2^E2 , reduced modulo one more than the maximum value representable in the result type. If E1 has a signed type and nonnegative value, and E1 * 2^E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined. So if bit 7 of Capacity10->LastLba3 is 1, (Capacity10->LastLba3 << 24) will be out of the range within int type. The undefined behavior of the signed left shift will lead to a potential of setting the high 32 bits of ScsiDiskDevice->BlkIo.Media->LastBlock to 1 during the cast from type int to type UINT64. This commit will add an explicit UINT32 type cast for Capacity10->LastLba3 to resolve this issue. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu Reviewed-by: Feng Tian Reviewed-by: Laszlo Ersek --- MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDisk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDisk.c b/MdeModulePkg/Bu= s/Scsi/ScsiDiskDxe/ScsiDisk.c index b5eff25b9b..2289f20152 100644 --- a/MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDisk.c +++ b/MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDisk.c @@ -1,7 +1,7 @@ /** @file SCSI disk driver that layers on every SCSI IO protocol in the system. =20 -Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.
+Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -2754,7 +2754,7 @@ GetMediaInfo ( UINT8 *Ptr; =20 if (!ScsiDiskDevice->Cdb16Byte) { - ScsiDiskDevice->BlkIo.Media->LastBlock =3D (Capacity10->LastLba3 << 2= 4) | + ScsiDiskDevice->BlkIo.Media->LastBlock =3D ((UINT32) Capacity10->Last= Lba3 << 24) | (Capacity10->LastLba2 << 16)= | (Capacity10->LastLba1 << 8) = | Capacity10->LastLba0; --=20 2.12.0.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Mon May 6 09:50:36 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1491961961407356.1123379323618; Tue, 11 Apr 2017 18:52:41 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 39B8B20D7649D; Tue, 11 Apr 2017 18:52:38 -0700 (PDT) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 87DFD20D7648C for ; Tue, 11 Apr 2017 18:52:35 -0700 (PDT) Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Apr 2017 18:52:35 -0700 Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by fmsmga001.fm.intel.com with ESMTP; 11 Apr 2017 18:52:34 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.37,187,1488873600"; d="scan'208";a="1134232238" From: Hao Wu To: edk2-devel@lists.01.org, guoheyi@huawei.com Date: Wed, 12 Apr 2017 09:52:25 +0800 Message-Id: <20170412015228.20328-3-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170412015228.20328-1-hao.a.wu@intel.com> References: <20170412015228.20328-1-hao.a.wu@intel.com> Subject: [edk2] [PATCH v3 2/5] MdeModulePkg/IdeBusPei: Fix undefined behavior in signed left shift X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hao Wu , Feng Tian MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" In function ReadCapacity(), the following expression: MediaInfo->LastBlock =3D (Data.LastLba3 << 24) | (Data.LastLba2 << 16) | (Data.LastLba1 << 8) | Data.LastLba0; (There is also a similar case in this function.) will involve undefined behavior in signed left shift operations. Since Data.LastLbaX is of type UINT8, and MediaInfo->LastBlock is of type UINTN. Therefore, Data.LastLbaX will be promoted to int (32 bits, signed) first, and then perform the left shift operation. According to the C11 spec, Section 6.5.7: 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has an unsigned type, the value of the result is E1 * 2^E2 , reduced modulo one more than the maximum value representable in the result type. If E1 has a signed type and nonnegative value, and E1 * 2^E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined. So if bit 7 of Data.LastLba3 is 1, (Data.LastLba3 << 24) will be out of the range within int type. The undefined behavior of the signed left shift will lead to a potential of setting the high 32 bits of MediaInfo->LastBlock to 1 during the cast from type int to type UINT64 for X64 builds. This commit will add an explicit UINT32 type cast for Data.LastLba3 to resolve this issue. Cc: Feng Tian Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu --- MdeModulePkg/Bus/Pci/IdeBusPei/AtapiPeim.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MdeModulePkg/Bus/Pci/IdeBusPei/AtapiPeim.c b/MdeModulePkg/Bus/= Pci/IdeBusPei/AtapiPeim.c index b1ab34d597..58bef161fb 100644 --- a/MdeModulePkg/Bus/Pci/IdeBusPei/AtapiPeim.c +++ b/MdeModulePkg/Bus/Pci/IdeBusPei/AtapiPeim.c @@ -2140,7 +2140,7 @@ ReadCapacity ( =20 if (MediaInfo->DeviceType =3D=3D IdeCDROM) { =20 - MediaInfo->LastBlock =3D (Data.LastLba3 << 24) | (Data.LastLba2 <= < 16) | (Data.LastLba1 << 8) | Data.LastLba0; + MediaInfo->LastBlock =3D ((UINT32) Data.LastLba3 << 24) | (Data.L= astLba2 << 16) | (Data.LastLba1 << 8) | Data.LastLba0; MediaInfo->MediaPresent =3D TRUE; // // Because the user data portion in the sector of the Data CD suppor= ted @@ -2161,7 +2161,7 @@ ReadCapacity ( MediaInfo2->MediaPresent =3D FALSE; MediaInfo2->LastBlock =3D 0; } else { - MediaInfo->LastBlock =3D (FormatData.LastLba3 << 24) | + MediaInfo->LastBlock =3D ((UINT32) FormatData.LastLba3 << 24) | (FormatData.LastLba2 << 16) | (FormatData.LastLba1 << 8) | FormatData.LastLba0; --=20 2.12.0.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Mon May 6 09:50:36 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 149196196344595.47623692734066; Tue, 11 Apr 2017 18:52:43 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 75B9F2095C3CC; Tue, 11 Apr 2017 18:52:38 -0700 (PDT) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id DD439207E57DD for ; Tue, 11 Apr 2017 18:52:36 -0700 (PDT) Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Apr 2017 18:52:36 -0700 Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by fmsmga001.fm.intel.com with ESMTP; 11 Apr 2017 18:52:35 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.37,187,1488873600"; d="scan'208";a="1134232244" From: Hao Wu To: edk2-devel@lists.01.org, guoheyi@huawei.com Date: Wed, 12 Apr 2017 09:52:26 +0800 Message-Id: <20170412015228.20328-4-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170412015228.20328-1-hao.a.wu@intel.com> References: <20170412015228.20328-1-hao.a.wu@intel.com> Subject: [edk2] [PATCH v3 3/5] MdeModulePkg/UfsBlkIoPei: Fix undefined behavior in signed left shift X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hao Wu , Feng Tian MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" In function UfsBlockIoPeimGetMediaInfo(), the following expression: Private->Media[DeviceIndex].LastBlock =3D (Capacity16.LastLba3 << 24) | (Capacity16.LastLba2 << 16) | (Capacity16.LastLba1 << 8) | Capacity16.LastLba0; (There is also a similar case in this function.) will involve undefined behavior in signed left shift operations. Since Capacity16.LastLbaX is of type UINT8, and Private->Media[DeviceIndex].LastBlock is of type UINT64. Therefore, Capacity16.LastLbaX will be promoted to int (32 bits, signed) first, and then perform the left shift operation. According to the C11 spec, Section 6.5.7: 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has an unsigned type, the value of the result is E1 * 2^E2 , reduced modulo one more than the maximum value representable in the result type. If E1 has a signed type and nonnegative value, and E1 * 2^E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined. So if bit 7 of Capacity16.LastLba3 is 1, (Capacity16.LastLba3 << 24) will be out of the range within int type. The undefined behavior of the signed left shift will lead to a potential of setting the high 32 bits of Private->Media[DeviceIndex].LastBlock to 1 during the cast from type int to type UINT64. This commit will add an explicit UINT32 type cast for Capacity16.LastLba3 to resolve this issue. Cc: Feng Tian Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu --- MdeModulePkg/Bus/Ufs/UfsBlockIoPei/UfsBlockIoPei.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/MdeModulePkg/Bus/Ufs/UfsBlockIoPei/UfsBlockIoPei.c b/MdeModule= Pkg/Bus/Ufs/UfsBlockIoPei/UfsBlockIoPei.c index cd7c59edae..ddeee3e1bc 100644 --- a/MdeModulePkg/Bus/Ufs/UfsBlockIoPei/UfsBlockIoPei.c +++ b/MdeModulePkg/Bus/Ufs/UfsBlockIoPei/UfsBlockIoPei.c @@ -1,6 +1,6 @@ /** @file =20 - Copyright (c) 2014 - 2016, Intel Corporation. All rights reserved.
+ Copyright (c) 2014 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BS= D License which accompanies this distribution. The full text of the license may b= e found at @@ -737,11 +737,11 @@ UfsBlockIoPeimGetMediaInfo ( if (EFI_ERROR (Status)) { return EFI_DEVICE_ERROR; } - Private->Media[DeviceIndex].LastBlock =3D (Capacity16.LastLba3 << 24)= | (Capacity16.LastLba2 << 16) | (Capacity16.LastLba1 << 8) | Capacity16.La= stLba0; + Private->Media[DeviceIndex].LastBlock =3D ((UINT32)Capacity16.LastLba= 3 << 24) | (Capacity16.LastLba2 << 16) | (Capacity16.LastLba1 << 8) | Capac= ity16.LastLba0; Private->Media[DeviceIndex].LastBlock |=3D LShiftU64 ((UINT64)Capacity= 16.LastLba7, 56) | LShiftU64((UINT64)Capacity16.LastLba6, 48) | LShiftU64 (= (UINT64)Capacity16.LastLba5, 40) | LShiftU64 ((UINT64)Capacity16.LastLba4, = 32); Private->Media[DeviceIndex].BlockSize =3D (Capacity16.BlockSize3 << 2= 4) | (Capacity16.BlockSize2 << 16) | (Capacity16.BlockSize1 << 8) | Capacit= y16.BlockSize0; } else { - Private->Media[DeviceIndex].LastBlock =3D (Capacity.LastLba3 << 24) |= (Capacity.LastLba2 << 16) | (Capacity.LastLba1 << 8) | Capacity.LastLba0; + Private->Media[DeviceIndex].LastBlock =3D ((UINT32)Capacity.LastLba3 = << 24) | (Capacity.LastLba2 << 16) | (Capacity.LastLba1 << 8) | Capacity.La= stLba0; Private->Media[DeviceIndex].BlockSize =3D (Capacity.BlockSize3 << 24)= | (Capacity.BlockSize2 << 16) | (Capacity.BlockSize1 << 8) | Capacity.Bloc= kSize0; } =20 --=20 2.12.0.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Mon May 6 09:50:36 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 14919619658811003.6248161741704; Tue, 11 Apr 2017 18:52:45 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id AE3532095C3DC; Tue, 11 Apr 2017 18:52:38 -0700 (PDT) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 571F520D764AD for ; Tue, 11 Apr 2017 18:52:38 -0700 (PDT) Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Apr 2017 18:52:38 -0700 Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by fmsmga001.fm.intel.com with ESMTP; 11 Apr 2017 18:52:36 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.37,187,1488873600"; d="scan'208";a="1134232249" From: Hao Wu To: edk2-devel@lists.01.org, guoheyi@huawei.com Date: Wed, 12 Apr 2017 09:52:27 +0800 Message-Id: <20170412015228.20328-5-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170412015228.20328-1-hao.a.wu@intel.com> References: <20170412015228.20328-1-hao.a.wu@intel.com> Subject: [edk2] [PATCH v3 4/5] MdeModulePkg/UsbBotPei: Fix undefined behavior in signed left shift X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hao Wu , Feng Tian MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" In function PeiUsbReadCapacity(), the following expression: LastBlock =3D (Data.LastLba3 << 24) | (Data.LastLba2 << 16) | (Data.LastLba1 << 8) | Data.LastLba0; (There is also a similar case in function PeiUsbReadFormattedCapacity().) will involve undefined behavior in signed left shift operations. Since Data.LastLbaX is of type UINT8, they will be promoted to int (32 bits, signed) first, and then perform the left shift operation. According to the C11 spec, Section 6.5.7: 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has an unsigned type, the value of the result is E1 * 2^E2 , reduced modulo one more than the maximum value representable in the result type. If E1 has a signed type and nonnegative value, and E1 * 2^E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined. So if bit 7 of Data.LastLba3 is 1, (Data.LastLba3 << 24) will be out of the range within int type. The undefined behavior of the signed left shift might incur potential issues. This commit will add an explicit UINT32 type cast for Data.LastLba3 to refine the codes. Cc: Feng Tian Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu --- MdeModulePkg/Bus/Usb/UsbBotPei/PeiAtapi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/MdeModulePkg/Bus/Usb/UsbBotPei/PeiAtapi.c b/MdeModulePkg/Bus/U= sb/UsbBotPei/PeiAtapi.c index eaad626d61..72bde756eb 100644 --- a/MdeModulePkg/Bus/Usb/UsbBotPei/PeiAtapi.c +++ b/MdeModulePkg/Bus/Usb/UsbBotPei/PeiAtapi.c @@ -1,7 +1,7 @@ /** @file Pei USB ATATPI command implementations. =20 -Copyright (c) 1999 - 2015, Intel Corporation. All rights reserved.
+Copyright (c) 1999 - 2017, Intel Corporation. All rights reserved.
=20 This program and the accompanying materials are licensed and made available under the terms and conditions @@ -274,7 +274,7 @@ PeiUsbReadCapacity ( if (EFI_ERROR (Status)) { return EFI_DEVICE_ERROR; } - LastBlock =3D (Data.LastLba3 << 24) | (Data.LastLba2 << 16) | (Data.Last= Lba1 << 8) | Data.LastLba0; + LastBlock =3D ((UINT32) Data.LastLba3 << 24) | (Data.LastLba2 << 16) | (= Data.LastLba1 << 8) | Data.LastLba0; =20 if (LastBlock =3D=3D 0xFFFFFFFF) { DEBUG ((EFI_D_INFO, "The usb device LBA count is larger than 0xFFFFFFF= F!\n")); @@ -346,7 +346,7 @@ PeiUsbReadFormattedCapacity ( PeiBotDevice->Media2.LastBlock =3D 0; =20 } else { - LastBlock =3D (FormatData.LastLba3 << 24) | (FormatData.LastLba2 << 16= ) | (FormatData.LastLba1 << 8) | FormatData.LastLba0; + LastBlock =3D ((UINT32) FormatData.LastLba3 << 24) | (FormatData.LastL= ba2 << 16) | (FormatData.LastLba1 << 8) | FormatData.LastLba0; if (LastBlock =3D=3D 0xFFFFFFFF) { DEBUG ((EFI_D_INFO, "The usb device LBA count is larger than 0xFFFFF= FFF!\n")); } --=20 2.12.0.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Mon May 6 09:50:36 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1491961968048375.76297549475703; Tue, 11 Apr 2017 18:52:48 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id E5E7E20D764AD; Tue, 11 Apr 2017 18:52:40 -0700 (PDT) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id B54B0207E57EA for ; Tue, 11 Apr 2017 18:52:39 -0700 (PDT) Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Apr 2017 18:52:39 -0700 Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by fmsmga001.fm.intel.com with ESMTP; 11 Apr 2017 18:52:38 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.37,187,1488873600"; d="scan'208";a="1134232254" From: Hao Wu To: edk2-devel@lists.01.org, guoheyi@huawei.com Date: Wed, 12 Apr 2017 09:52:28 +0800 Message-Id: <20170412015228.20328-6-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170412015228.20328-1-hao.a.wu@intel.com> References: <20170412015228.20328-1-hao.a.wu@intel.com> Subject: [edk2] [PATCH v3 5/5] IntelFWMdlPkg/IdeBusDxe: Fix undefined behavior in signed left shift X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hao Wu , Feng Tian MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" In function AtapiReadCapacity(), the following expression: IdeDev->BlkIo.Media->LastBlock =3D (Data.LastLba3 << 24) | (Data.LastLba2 << 16) | (Data.LastLba1 << 8) | Data.LastLba0; (There is also a similar case in this function.) will involve undefined behavior in signed left shift operations. Since Data.LastLbaX is of type UINT8, and IdeDev->BlkIo.Media->LastBlock is of type UINT64. Therefore, Data.LastLbaX will be promoted to int (32 bits, signed) first, and then perform the left shift operation. According to the C11 spec, Section 6.5.7: 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros. If E1 has an unsigned type, the value of the result is E1 * 2^E2 , reduced modulo one more than the maximum value representable in the result type. If E1 has a signed type and nonnegative value, and E1 * 2^E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined. So if bit 7 of Data.LastLba3 is 1, (Data.LastLba3 << 24) will be out of the range within int type. The undefined behavior of the signed left shift will lead to a potential of setting the high 32 bits of IdeDev->BlkIo.Media->LastBlock to 1 during the cast from type int to type UINT64. This commit will add an explicit UINT32 type cast for Data.LastLba3 to resolve this issue. Cc: Feng Tian Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu --- IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/Atapi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/Atapi.c b/IntelFrame= workModulePkg/Bus/Pci/IdeBusDxe/Atapi.c index 1a3cb2e0a0..c641dc5714 100644 --- a/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/Atapi.c +++ b/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/Atapi.c @@ -1,7 +1,7 @@ /** @file This file contains all helper functions on the ATAPI command=20 =20 - Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.
+ Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials =20 are licensed and made available under the terms and conditions of the BS= D License =20 which accompanies this distribution. The full text of the license may b= e found at =20 @@ -1053,7 +1053,7 @@ AtapiReadCapacity ( if (!EFI_ERROR (Status) && *SResult =3D=3D SenseNoSenseKey) { if (IdeDev->Type =3D=3D IdeCdRom) { =20 - IdeDev->BlkIo.Media->LastBlock =3D (Data.LastLba3 << 24) | + IdeDev->BlkIo.Media->LastBlock =3D ((UINT32) Data.LastLba3 << 24) | (Data.LastLba2 << 16) | (Data.LastLba1 << 8) | Data.LastLba0; @@ -1076,7 +1076,7 @@ AtapiReadCapacity ( IdeDev->BlkIo.Media->LastBlock =3D 0; } else { =20 - IdeDev->BlkIo.Media->LastBlock =3D (FormatData.LastLba3 << 24) | + IdeDev->BlkIo.Media->LastBlock =3D ((UINT32) FormatData.LastLba3= << 24) | (FormatData.LastLba2 << 16) |=20 (FormatData.LastLba1 << 8) | FormatData.LastLba0; --=20 2.12.0.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel