REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1934

0x0       MicrocodeBegin  MicrocodeEntry  MicrocodeEnd      0xffffffff
|--------------|---------------|---------------|---------------|
                                 valid TotalSize
TotalSize is only valid between 0 and (MicrocodeEnd - MicrocodeEntry).
So add '(UINTN)MicrocodeEntryPoint > (MAX_ADDRESS - TotalSize)' before
'((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd' to make sure
((UINTN)MicrocodeEntryPoint + TotalSize) wouldn't overflow.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Liming Gao <liming.gao@intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
---
 UefiCpuPkg/Library/MpInitLib/Microcode.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/UefiCpuPkg/Library/MpInitLib/Microcode.c b/UefiCpuPkg/Library/MpInitLib/Microcode.c
index 4763dcfebe..c30df58e5a 100644
--- a/UefiCpuPkg/Library/MpInitLib/Microcode.c
+++ b/UefiCpuPkg/Library/MpInitLib/Microcode.c
@@ -1,7 +1,7 @@
 /** @file
   Implementation of loading microcode on processors.
 
-  Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2015 - 2019, Intel Corporation. All rights reserved.<BR>
   SPDX-License-Identifier: BSD-2-Clause-Patent
 
 **/
@@ -167,9 +167,15 @@ MicrocodeDetect (
     }
 
     ///
-    /// Check overflow and whether TotalSize is aligned with 4 bytes.
+    /// 0x0       MicrocodeBegin  MicrocodeEntry  MicrocodeEnd      0xffffffff
+    /// |--------------|---------------|---------------|---------------|
+    ///                                 valid TotalSize
+    /// TotalSize is only valid between 0 and (MicrocodeEnd - MicrocodeEntry).
+    /// And it should be aligned with 4 bytes.
+    /// If the TotalSize is invalid skip 1KB the check next entry.
     ///
-    if ( ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd ||
+    if ( (UINTN)MicrocodeEntryPoint > (MAX_ADDRESS - TotalSize) ||
+         ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd ||
          (TotalSize & 0x3) != 0
        ) {
       MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN) MicrocodeEntryPoint) + SIZE_1KB);
-- 
2.21.0.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#42866): https://edk2.groups.io/g/devel/message/42866
Mute This Topic: https://groups.io/mt/32212210/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Reviewed-by: Ray Ni <ray.ni@intel.com>

> -----Original Message-----
> From: Gao, Zhichao <zhichao.gao@intel.com>
> Sent: Wednesday, June 26, 2019 1:32 PM
> To: devel@edk2.groups.io
> Cc: Dong, Eric <eric.dong@intel.com>; Ni, Ray <ray.ni@intel.com>; Laszlo
> Ersek <lersek@redhat.com>; Gao, Liming <liming.gao@intel.com>
> Subject: [PATCH v3] UefiCpuPkg/MpInitLib: MicrocodeDetect: Ensure
> checked range is valid
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1934
> 
> 0x0       MicrocodeBegin  MicrocodeEntry  MicrocodeEnd      0xffffffff
> |--------------|---------------|---------------|---------------|
>                                  valid TotalSize TotalSize is only valid between 0 and
> (MicrocodeEnd - MicrocodeEntry).
> So add '(UINTN)MicrocodeEntryPoint > (MAX_ADDRESS - TotalSize)' before
> '((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd' to make sure
> ((UINTN)MicrocodeEntryPoint + TotalSize) wouldn't overflow.
> 
> Cc: Eric Dong <eric.dong@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
> ---
>  UefiCpuPkg/Library/MpInitLib/Microcode.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/UefiCpuPkg/Library/MpInitLib/Microcode.c
> b/UefiCpuPkg/Library/MpInitLib/Microcode.c
> index 4763dcfebe..c30df58e5a 100644
> --- a/UefiCpuPkg/Library/MpInitLib/Microcode.c
> +++ b/UefiCpuPkg/Library/MpInitLib/Microcode.c
> @@ -1,7 +1,7 @@
>  /** @file
>    Implementation of loading microcode on processors.
> 
> -  Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
> +  Copyright (c) 2015 - 2019, Intel Corporation. All rights
> + reserved.<BR>
>    SPDX-License-Identifier: BSD-2-Clause-Patent
> 
>  **/
> @@ -167,9 +167,15 @@ MicrocodeDetect (
>      }
> 
>      ///
> -    /// Check overflow and whether TotalSize is aligned with 4 bytes.
> +    /// 0x0       MicrocodeBegin  MicrocodeEntry  MicrocodeEnd      0xffffffff
> +    /// |--------------|---------------|---------------|---------------|
> +    ///                                 valid TotalSize
> +    /// TotalSize is only valid between 0 and (MicrocodeEnd -
> MicrocodeEntry).
> +    /// And it should be aligned with 4 bytes.
> +    /// If the TotalSize is invalid skip 1KB the check next entry.
>      ///
> -    if ( ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd ||
> +    if ( (UINTN)MicrocodeEntryPoint > (MAX_ADDRESS - TotalSize) ||
> +         ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd ||
>           (TotalSize & 0x3) != 0
>         ) {
>        MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN)
> MicrocodeEntryPoint) + SIZE_1KB);
> --
> 2.21.0.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#42869): https://edk2.groups.io/g/devel/message/42869
Mute This Topic: https://groups.io/mt/32212210/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-