From nobody Tue Nov 26 13:27:02 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+53867+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+53867+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1580998777325396.67781970598014; Thu, 6 Feb 2020 06:19:37 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id kxKcYY1788612x6UBc2MO8bl; Thu, 06 Feb 2020 06:19:36 -0800 X-Received: from mga02.intel.com (mga02.intel.com []) by mx.groups.io with SMTP id smtpd.web11.12696.1580998775768725774 for ; Thu, 06 Feb 2020 06:19:36 -0800 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Feb 2020 06:19:35 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,409,1574150400"; d="scan'208";a="226160662" X-Received: from shwdeopensfp777.ccr.corp.intel.com ([10.239.158.78]) by fmsmga008.fm.intel.com with ESMTP; 06 Feb 2020 06:19:35 -0800 From: "Wang, Jian J" To: devel@edk2.groups.io Cc: Jiewen Yao , Chao Zhang Subject: [edk2-devel] [PATCH 1/9] SecurityPkg/DxeImageVerificationLib: Fix memory leaks(CVE-2019-14575) Date: Thu, 6 Feb 2020 22:19:25 +0800 Message-Id: <20200206141933.356-2-jian.j.wang@intel.com> In-Reply-To: <20200206141933.356-1-jian.j.wang@intel.com> References: <20200206141933.356-1-jian.j.wang@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,jian.j.wang@intel.com X-Gm-Message-State: HsjdtMXFNxXIAOx5BiSulWLJx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1580998776; bh=9WnF6YE/G6ZLkhyzY08qOY5ltiDdhQyqANXd4pnuvu0=; h=Cc:Date:From:Reply-To:Subject:To; b=qzpBoDc+ALmc361Ulu2dSQrA1Dez6xqjkw23vNfzz7qiBX22imtz8DY0x57NfZa9Rhn gtxH8fMRjStkyUeRv4WRsrjaPqYsKy3imEXi1m1Eft2eghjvQPTLNFvnTQMbWMx6zzawZ gGK4b0f0iIr+4knBzQKlDvOeJWoAeB4td6U= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1608 Pointer HashCtx used in IsCertHashFoundInDatabase() is not freed inside the while-loop, if it will run more than once. Cc: Jiewen Yao Cc: Chao Zhang Signed-off-by: Jian J Wang Reviewed-by: Jiewen Yao Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificati= onLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationL= ib.c index dbfbfcb4fb..74dbffa122 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c @@ -908,6 +908,9 @@ IsCertHashFoundInDatabase ( goto Done; } =20 + FreePool (HashCtx); + HashCtx =3D NULL; + SiglistHeaderSize =3D sizeof (EFI_SIGNATURE_LIST) + DbxList->Signature= HeaderSize; CertHash =3D (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + Sigl= istHeaderSize); CertHashCount =3D (DbxList->SignatureListSize - SiglistHeaderSize)= / DbxList->SignatureSize; --=20 2.24.0.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#53867): https://edk2.groups.io/g/devel/message/53867 Mute This Topic: https://groups.io/mt/71023417/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-