From nobody Tue Apr 23 08:05:56 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1496211212165121.18951192350801; Tue, 30 May 2017 23:13:32 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 89D8D21AEBADF; Tue, 30 May 2017 23:12:30 -0700 (PDT) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 2223921AE3CD9 for ; Tue, 30 May 2017 23:12:27 -0700 (PDT) Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 30 May 2017 23:13:27 -0700 Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by fmsmga005.fm.intel.com with ESMTP; 30 May 2017 23:13:25 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.38,422,1491289200"; d="scan'208";a="108548396" From: Hao Wu To: edk2-devel@lists.01.org Date: Wed, 31 May 2017 14:13:18 +0800 Message-Id: <20170531061319.21976-2-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170531061319.21976-1-hao.a.wu@intel.com> References: <20170531061319.21976-1-hao.a.wu@intel.com> Subject: [edk2] [PATCH v2 1/2] MdePkg/BasePrintLib: Avoid reading content beyond the format string X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hao Wu , Michael Kinney , Jiewen Yao , Liming Gao MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" https://bugzilla.tianocore.org/show_bug.cgi?id=3D567 In function BasePrintLibSPrintMarker(), when processing ASCII format strings, if the format string walker pointer 'Format' is pointing at the end of the format string (i.e. '\0'), the following expression: *(Format + 1) will read an undefined value. Though this value won't affect the functionality, since it will be masked by variable 'FormatMask': (*(Format + 1) << 8)) & FormatMask (FormatMask is 0xff for ASCII format string) This commit adds additional logic to avoid reading undefined content. Cc: Jiewen Yao Cc: Liming Gao Cc: Michael Kinney Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu Reviewed-by: Liming Gao --- MdePkg/Library/BasePrintLib/PrintLibInternal.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c b/MdePkg/Librar= y/BasePrintLib/PrintLibInternal.c index 9b15a07ac0..cec5b3bc99 100644 --- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c +++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c @@ -653,7 +653,7 @@ BasePrintLibSPrintMarker ( // // Get the first character from the format string // - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMa= sk; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter =3D=3D= 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; =20 // // Loop until the end of the format string is reached or the output buff= er is full @@ -685,7 +685,7 @@ BasePrintLibSPrintMarker ( // for (Done =3D FALSE; !Done; ) { Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Fo= rmatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; switch (FormatCharacter) { case '.':=20 Flags |=3D PRECISION;=20 @@ -738,7 +738,7 @@ BasePrintLibSPrintMarker ( for (Count =3D 0; ((FormatCharacter >=3D '0') && (FormatCharact= er <=3D '9')); ){ Count =3D (Count * 10) + FormatCharacter - '0'; Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) = & FormatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharac= ter =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; } Format -=3D BytesPerFormatCharacter; if ((Flags & PRECISION) =3D=3D 0) { @@ -1017,7 +1017,7 @@ BasePrintLibSPrintMarker ( =20 case '\r': Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Fo= rmatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; if (FormatCharacter =3D=3D '\n') { // // Translate '\r\n' to '\r\n' @@ -1038,7 +1038,7 @@ BasePrintLibSPrintMarker ( // ArgumentString =3D "\r\n"; Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Fo= rmatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; if (FormatCharacter !=3D '\r') { Format -=3D BytesPerFormatCharacter; } @@ -1057,7 +1057,7 @@ BasePrintLibSPrintMarker ( =20 case '\r': Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Form= atMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; if (FormatCharacter =3D=3D '\n') { // // Translate '\r\n' to '\r\n' @@ -1078,7 +1078,7 @@ BasePrintLibSPrintMarker ( // ArgumentString =3D "\r\n"; Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Form= atMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; if (FormatCharacter !=3D '\r') { Format -=3D BytesPerFormatCharacter; } @@ -1206,7 +1206,7 @@ BasePrintLibSPrintMarker ( // // Get the next character from the format string // - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Format= Mask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter =3D= =3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; } =20 if ((Flags & COUNT_ONLY_NO_PRINT) !=3D 0) { --=20 2.12.0.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel From nobody Tue Apr 23 08:05:56 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1496211214118619.940723443622; Tue, 30 May 2017 23:13:34 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id C787D21AF39A2; Tue, 30 May 2017 23:12:30 -0700 (PDT) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 99B2F21AEBABF for ; Tue, 30 May 2017 23:12:28 -0700 (PDT) Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 30 May 2017 23:13:28 -0700 Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by fmsmga005.fm.intel.com with ESMTP; 30 May 2017 23:13:27 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.38,422,1491289200"; d="scan'208";a="108548408" From: Hao Wu To: edk2-devel@lists.01.org Date: Wed, 31 May 2017 14:13:19 +0800 Message-Id: <20170531061319.21976-3-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170531061319.21976-1-hao.a.wu@intel.com> References: <20170531061319.21976-1-hao.a.wu@intel.com> Subject: [edk2] [PATCH v2 2/2] MdeModulePkg/PrintLib: Avoid reading content beyond the format string X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hao Wu , Michael Kinney , Jiewen Yao , Liming Gao MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" https://bugzilla.tianocore.org/show_bug.cgi?id=3D567 In functions DxePrintLibPrint2ProtocolVaListToBaseList() and InternalPrintLibSPrintMarker(), when processing ASCII format strings, if the format string walker pointer 'Format' is pointing at the end of the format string (i.e. '\0'), the following expression: *(Format + 1) will read an undefined value. Though this value won't affect the functionality, since it will be masked by variable 'FormatMask': (*(Format + 1) << 8)) & FormatMask (FormatMask is 0xff for ASCII format string) This commit adds additional logic to avoid reading undefined content. Cc: Jiewen Yao Cc: Liming Gao Cc: Michael Kinney Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu Reviewed-by: Liming Gao --- MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c | 22 ++++++++++-= --------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c b/Md= eModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c index 9f702c4fef..b58db8e011 100644 --- a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c +++ b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c @@ -130,7 +130,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList ( // // Get the first character from the format string // - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMa= sk; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter =3D=3D= 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; =20 while (FormatCharacter !=3D 0) { if (FormatCharacter =3D=3D '%') { @@ -148,7 +148,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList ( // // Get the next character from the format string // - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Fo= rmatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; =20 switch (FormatCharacter) { case '.':=20 @@ -239,7 +239,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList ( // // Get the next character from the format string // - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Format= Mask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter =3D= =3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; } return TRUE; } @@ -1596,7 +1596,7 @@ InternalPrintLibSPrintMarker ( // // Get the first character from the format string // - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMa= sk; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter =3D=3D= 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; =20 // // Loop until the end of the format string is reached or the output buff= er is full @@ -1628,7 +1628,7 @@ InternalPrintLibSPrintMarker ( // for (Done =3D FALSE; !Done; ) { Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Fo= rmatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; switch (FormatCharacter) { case '.':=20 Flags |=3D PRECISION;=20 @@ -1681,7 +1681,7 @@ InternalPrintLibSPrintMarker ( for (Count =3D 0; ((FormatCharacter >=3D '0') && (FormatCharact= er <=3D '9')); ){ Count =3D (Count * 10) + FormatCharacter - '0'; Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) = & FormatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharac= ter =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; } Format -=3D BytesPerFormatCharacter; if ((Flags & PRECISION) =3D=3D 0) { @@ -1960,7 +1960,7 @@ InternalPrintLibSPrintMarker ( =20 case '\r': Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Fo= rmatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; if (FormatCharacter =3D=3D '\n') { // // Translate '\r\n' to '\r\n' @@ -1981,7 +1981,7 @@ InternalPrintLibSPrintMarker ( // ArgumentString =3D "\r\n"; Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Fo= rmatMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; if (FormatCharacter !=3D '\r') { Format -=3D BytesPerFormatCharacter; } @@ -2000,7 +2000,7 @@ InternalPrintLibSPrintMarker ( =20 case '\r': Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Form= atMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; if (FormatCharacter =3D=3D '\n') { // // Translate '\r\n' to '\r\n' @@ -2021,7 +2021,7 @@ InternalPrintLibSPrintMarker ( // ArgumentString =3D "\r\n"; Format +=3D BytesPerFormatCharacter; - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Form= atMask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter = =3D=3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; if (FormatCharacter !=3D '\r') { Format -=3D BytesPerFormatCharacter; } @@ -2149,7 +2149,7 @@ InternalPrintLibSPrintMarker ( // // Get the next character from the format string // - FormatCharacter =3D ((*Format & 0xff) | (*(Format + 1) << 8)) & Format= Mask; + FormatCharacter =3D ((*Format & 0xff) | ((BytesPerFormatCharacter =3D= =3D 1) ? 0 : (*(Format + 1) << 8))) & FormatMask; } =20 if ((Flags & COUNT_ONLY_NO_PRINT) !=3D 0) { --=20 2.12.0.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel