From nobody Fri Mar 29 00:16:11 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+53185+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+53185+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1578903547; cv=none; d=zohomail.com; s=zohoarc; b=bO/0HlzzL9qqmdmLdvnVyrsJNbBi5KkWQ4EaDDRwkTXgjq0lrm96pt/TPj9iLX358E1AzU2xAPBLw2DqtHSUOTqt5pe4zrCCU8FG6+sRbgsfmzxnRvNA12hwcaXT8MDzt2pqcHIvC8IfA+FHH3JcksBsJ129hXMnxZXa5x3aCIw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1578903547; h=Cc:Date:From:List-Id:List-Unsubscribe:Message-ID:Reply-To:Sender:Subject:To; bh=h3GUOhYE39GlJesht0zpRFtP4NeTiwQqZ6AbOgcRRvg=; b=co4Nb32VMoixmg16q8oBCk7HLidtWgwU03IhK33t6PgG0pUoFGWfMZtqsKL8SYHODJBEZGtftIRbtzlvDNWrNI98y1KSCAQGbR9tDrtJdf9ujAZ1TbB0wXP+XwyrAVsMjov7UlbTG6HT0ILPQkNw3LBbzny7RoSwLd0bzLqamyY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+53185+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1578903547026408.214896819488; Mon, 13 Jan 2020 00:19:07 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id zhB2YY1788612xOkgHGgKHFK; Mon, 13 Jan 2020 00:19:05 -0800 X-Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by mx.groups.io with SMTP id smtpd.web11.35134.1578903544991146850 for ; Mon, 13 Jan 2020 00:19:05 -0800 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 Jan 2020 00:19:04 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.69,428,1571727600"; d="scan'208";a="304781163" X-Received: from fieedk002.ccr.corp.intel.com ([10.239.158.170]) by orsmga001.jf.intel.com with ESMTP; 13 Jan 2020 00:19:03 -0800 From: "Zhiguang Liu" To: devel@edk2.groups.io Cc: Jian J Wang , Hao A Wu Subject: [edk2-devel] [PATCH] MdePkg: PE loader should zero out dest buffer on allocation Date: Mon, 13 Jan 2020 16:18:53 +0800 Message-Id: <20200113081854.9732-1-zhiguang.liu@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,zhiguang.liu@intel.com X-Gm-Message-State: m37sqab45VuWJ1evLf4kn0rCx1787277AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1578903545; bh=UhVTwtplinBTDu2wptbOAKQ0qE8StvIWY7vbg3zuNUA=; h=Cc:Date:From:Reply-To:Subject:To; b=ptk7qVQ4o1JWX9hKy9ujzYA+6RHRes2uchjvlqyK66fxMK0VUvlL4KFkzX4VGOwQvbg tQks2HezRvmohCxai3tmknu9X2A7wG8gHByhy74AghlY43mJHwVNPvoQhi03qFCfLdMNK tjINhpn8FN1WLGCzcGVWPGtHBZmJ4iKg74o= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1999 When PE loader loads image to memory, the first section of image may not locate right next to the image header, which causes some memory space remaining uninitialized. This is a security issue. This patch compares the ending address of image header and the beginning address of the first section. If there is a gap, zero out this gap. Cc: Jian J Wang Cc: Hao A Wu Signed-off-by: Zhiguang Liu --- MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/Bas= ePeCoffLib/BasePeCoff.c index 07bb62f860..2cdfb4a082 100644 --- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c +++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c @@ -1306,6 +1306,14 @@ PeCoffLoaderLoadImage ( // Load each section of the image // Section =3D FirstSection; + // + // Zero out the memory space between image header and the first section + // + End =3D (CHAR8 *)(ImageContext->ImageAddress + ImageContext->SizeOfHead= ers); + Base =3D PeCoffLoaderImageAddress (ImageContext, Section->VirtualAddress= , TeStrippedOffset); + if (End < Base) { + ZeroMem (End, Base - End); + } for (Index =3D 0; Index < NumberOfSections; Index++) { // // Read the section --=20 2.16.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#53185): https://edk2.groups.io/g/devel/message/53185 Mute This Topic: https://groups.io/mt/69664451/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-