From nobody Sun May 5 09:42:55 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+56805+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+56805+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1585703479; cv=none; d=zohomail.com; s=zohoarc; b=KNLomivMU9CMe6zl4kUS9IYGnCma7W+RQKwyZredM0xGEI/yUSPtqMD5gCuZdYRYPgnJhIEqEONQVpri73NISAfAFvuoSf5bKDuJbomPGeflsHO58S7a+FDGP1r/7PAUzewnixQtdKSeIII8OF+QSMaiwW5jCTWQnnzee+Gv08w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1585703479; h=Content-Transfer-Encoding:Cc:Date:From:List-Id:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Sender:Subject:To; bh=fv+jGIHjxNtPck/qQeqqF+f/wAjkhMgBF+CyE0aWZSc=; b=hYUzuMYXKroTWRh5hfaspsWBkadlxcQcxrSwqhJqmtzY4DAEaNWRqmIFhopodkMbtX4rBAiPwD7ibvLW441i78gZjFBlmBFsBcUP8+wDfS2uJiWx3juYZZYoCTKsgFpkXVBGLp3lro7Il8uqDv31Xosh4w2jhAW2T7EPByP5KY8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+56805+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1585703479816830.1118361189455; Tue, 31 Mar 2020 18:11:19 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id mFOmYY1788612xM8x80daoOi; Tue, 31 Mar 2020 18:11:19 -0700 X-Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by mx.groups.io with SMTP id smtpd.web12.2437.1585703478798021121 for ; Tue, 31 Mar 2020 18:11:18 -0700 IronPort-SDR: iTwU0bHGPiSYwMv78KsWvHiug5l2+XB39lq+kik5/u9PaWSMsJ5NhVTGTKW6/0lyA2zHO8CEDF 3q4rlIliwGig== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 Mar 2020 18:11:16 -0700 IronPort-SDR: 5WXq0W/V2HTMd6urWX4V3b6nRmtx/HN3SsGT2n1c2bNud4RSFH2XGVCk4iLmmNDo75QaKEMUV0 BDeXIfdtGFwg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,329,1580803200"; d="scan'208";a="272961151" X-Received: from guominji-mobl.ccr.corp.intel.com ([10.238.5.173]) by fmsmga004.fm.intel.com with ESMTP; 31 Mar 2020 18:11:14 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Chao Zhang Subject: [edk2-devel] [PATCH] SecurityPkg/MeasureBootLib: Return EFI_ACCESS_DENIED after image check fail Date: Wed, 1 Apr 2020 09:11:13 +0800 Message-Id: <20200401011113.624-1-guomin.jiang@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,guomin.jiang@intel.com X-Gm-Message-State: kPIOMKJRkE32UV8VCGKgHpYBx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1585703479; bh=jkZPwGrIyRVZrWgLD0VW/Yj2A78Zql5VvZ/NnHsYWUQ=; h=Cc:Date:From:Reply-To:Subject:To; b=v/y8ZbpiVwZ9WG6DV2Gt1kUKLUCx7LIrE91j2p74GsjqNfojsJO8DfoByF7IXVOh1AT /cNjzNLMn42aLKbcLo+vEjc0TUy7RqSmZxjM/8lS74h/xbIho9osFEhjZNUNUvwStWtkg EEmGgEzmUztBu4QPt3YmLLvblEnWik4JXQA= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2652 If check the File at the begin of function, it will only allow the File is present and forbid image from buffer. It is possible that image come from the memory buffer, so make it can run and check the File after it. It is improvement for 4b026f0d5af36faf3a3629a3ad49c51b5b3be12f. Cc: Jiewen Yao Cc: Jian J Wang Cc: Chao Zhang Signed-off-by: Guomin Jiang --- .../DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c | 14 +++++++------- .../DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c | 14 +++++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLi= b.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c index f0e95e5ec0..fdb4758cbe 100644 --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c @@ -435,13 +435,6 @@ DxeTpm2MeasureBootHandler ( EFI_PHYSICAL_ADDRESS FvAddress; UINT32 Index; =20 - // - // Check for invalid parameters. - // - if (File =3D=3D NULL) { - return EFI_ACCESS_DENIED; - } - Status =3D gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &= Tcg2Protocol); if (EFI_ERROR (Status)) { // @@ -615,6 +608,13 @@ DxeTpm2MeasureBootHandler ( // Status =3D PeCoffLoaderGetImageInfo (&ImageContext); if (EFI_ERROR (Status)) { + // + // Check for invalid parameters. + // + if (File =3D=3D NULL) { + Status =3D EFI_ACCESS_DENIED; + } + // // The information can't be got from the invalid PeImage // diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.= c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c index d499371e7a..20f7d94d6b 100644 --- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c +++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c @@ -732,13 +732,6 @@ DxeTpmMeasureBootHandler ( EFI_PHYSICAL_ADDRESS FvAddress; UINT32 Index; =20 - // - // Check for invalid parameters. - // - if (File =3D=3D NULL) { - return EFI_ACCESS_DENIED; - } - Status =3D gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **) &T= cgProtocol); if (EFI_ERROR (Status)) { // @@ -912,6 +905,13 @@ DxeTpmMeasureBootHandler ( // Status =3D PeCoffLoaderGetImageInfo (&ImageContext); if (EFI_ERROR (Status)) { + // + // Check for invalid parameters. + // + if (File =3D=3D NULL) { + return EFI_ACCESS_DENIED; + } + // // The information can't be got from the invalid PeImage // --=20 2.25.1.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#56805): https://edk2.groups.io/g/devel/message/56805 Mute This Topic: https://groups.io/mt/72691331/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-