SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Add 'Index < HASH_COUNT' to ensure things out of digests[]
can not be visited.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com>
---
v2: Remove the comma operator and use &&.
SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
index 36c240d1221c..d7bc94006003 100644
--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
@@ -299,7 +299,7 @@ GetDigestListSize (
UINT32 TotalSize;
TotalSize = sizeof(DigestList->count);
- for (Index = 0; Index < DigestList->count; Index++) {
+ for (Index = 0; Index < DigestList->count && Index < HASH_COUNT; Index++) {
DigestSize = GetHashSizeFromAlgo (DigestList->digests[Index].hashAlg);
TotalSize += sizeof(DigestList->digests[Index].hashAlg) + DigestSize;
}
--
2.18.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#52242): https://edk2.groups.io/g/devel/message/52242
Mute This Topic: https://groups.io/mt/68718554/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
I don't think it is good idea to *ignore* the error. If you don't assert, please stop processor and return error. > -----Original Message----- > From: Zhang, Shenglei <shenglei.zhang@intel.com> > Sent: Monday, December 16, 2019 3:53 PM > To: devel@edk2.groups.io > Cc: Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; > Zhang, Chao B <chao.b.zhang@intel.com> > Subject: [PATCH v2] SecurityPkg/Tpm2Help.c: Add boundary check for array > > Add 'Index < HASH_COUNT' to ensure things out of digests[] > can not be visited. > > Cc: Jiewen Yao <jiewen.yao@intel.com> > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Chao Zhang <chao.b.zhang@intel.com> > Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> > --- > v2: Remove the comma operator and use &&. > > SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c > b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c > index 36c240d1221c..d7bc94006003 100644 > --- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c > +++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c > @@ -299,7 +299,7 @@ GetDigestListSize ( > UINT32 TotalSize; > > TotalSize = sizeof(DigestList->count); > - for (Index = 0; Index < DigestList->count; Index++) { > + for (Index = 0; Index < DigestList->count && Index < HASH_COUNT; Index++) { > DigestSize = GetHashSizeFromAlgo (DigestList->digests[Index].hashAlg); > TotalSize += sizeof(DigestList->digests[Index].hashAlg) + DigestSize; > } > -- > 2.18.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#52243): https://edk2.groups.io/g/devel/message/52243 Mute This Topic: https://groups.io/mt/68718554/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
© 2016 - 2024 Red Hat, Inc.