From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100102+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100102+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303383; cv=none; d=zohomail.com; s=zohoarc; b=hR4H4KoSmZUTYblcpXF2kjrtzvXFJ0JwR79DdTDgRn8oH1poigLxs8z4h7ZS1oVAwkAPKtBQq9wZyLwdC/fpzs+NilcaOuUYUaoMAHu/T1RQGcxUGicLQAWIGbVDRaRMF77Eec83YOoUko9bknVBOf5FrkKUbrlZ+GOV3p/TMSY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303383; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=kIr4Rf4uK0dpMRvdRJZnoJft4ig/Up0OTA0FYqWNmn8=; b=f4AVQ2yBUn1dXXEjIOyhkN8POSPs1XOHodGqI5neFYpDz4/QDGqkLEsOIHjOwqwEpycTo6kQ5d0Ca+QMiMI0MWX1JomQPZimHGHaBA4sZbk9e95gbRWGTAQDLawgdH6C/ClSNiS3lImAb86PUEZkcIcrlk9T1okcPXqZIFOuzt8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100102+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303383560642.120997456101; Mon, 13 Feb 2023 07:49:43 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id jXFsYY1788612xMgHjqXF9PK; Mon, 13 Feb 2023 07:49:42 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web11.17962.1676303382236707384 for ; Mon, 13 Feb 2023 07:49:42 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 5332720C8B73; Mon, 13 Feb 2023 07:49:40 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 5332720C8B73 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Dandan Bi , Erich McMillan , Jian J Wang , Liming Gao , Michael Kubacki , Star Zeng , Zhichao Gao , Zhiguang Liu , Michael Kubacki Subject: [edk2-devel] [PATCH v3 01/12] MdeModulePkg/SmbiosDxe: Fix pointer and buffer overflow CodeQL alerts Date: Mon, 13 Feb 2023 10:48:57 -0500 Message-Id: <20230213154908.1993-2-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: 1FBMDKR3U3lioAAxzP4qhKYyx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303382; bh=jYiknVXQQEe7YQeBWu6PnT7eh1qr+yXDYZRunOt8aDY=; h=Cc:Date:From:Reply-To:Subject:To; b=qeXSkoKCWFZK4zXsR9aM+MmEogv0pvJLswV5yIIjeczxuR0Gou34eG0sWIgL2li/7cF ZTbIeH73bNZiRSWMGMYkfSME8DNSfDepTfKzoW51Nb4pNOlLpmAYuk5VUYI8W8NqmpqbK hr3tg2FXFK21xDeS9x9rD7B+zPxRF8la3fA= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303384809100002 Content-Type: text/plain; charset="utf-8" From: Erich McMillan Details for these CodeQL alerts can be found here: - Pointer overflow check (cpp/pointer-overflow-check): - https://cwe.mitre.org/data/definitions/758.html - Potential buffer overflow check (cpp/potential-buffer-overflow): - https://cwe.mitre.org/data/definitions/676.html CodeQL alert: - Line 1612 in MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.c - Type: Pointer overflow check - Severity: Low - Problem: Range check relying on pointer overflow Cc: Dandan Bi Cc: Erich McMillan Cc: Jian J Wang Cc: Liming Gao Cc: Michael Kubacki Cc: Star Zeng Cc: Zhichao Gao Cc: Zhiguang Liu Co-authored-by: Michael Kubacki Signed-off-by: Erich McMillan Reviewed-by: Liming Gao --- MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.c | 11 ++++++++--- MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.inf | 1 + 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.c b/MdeModulePkg/Un= iversal/SmbiosDxe/SmbiosDxe.c index 1d43adc7662c..c1da2adc296b 100644 --- a/MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.c +++ b/MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.c @@ -8,6 +8,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent **/ =20 #include "SmbiosDxe.h" +#include =20 // // Module Global: @@ -1594,6 +1595,7 @@ ParseAndAddExistingSmbiosTable ( CHAR8 *String; EFI_SMBIOS_HANDLE SmbiosHandle; SMBIOS_STRUCTURE_POINTER SmbiosEnd; + UINTN SafeIntResult; =20 mPrivateData.Smbios.MajorVersion =3D MajorVersion; mPrivateData.Smbios.MinorVersion =3D MinorVersion; @@ -1608,9 +1610,12 @@ ParseAndAddExistingSmbiosTable ( // // Make sure not to access memory beyond SmbiosEnd // - if ((Smbios.Raw + sizeof (SMBIOS_STRUCTURE) > SmbiosEnd.Raw) || - (Smbios.Raw + sizeof (SMBIOS_STRUCTURE) < Smbios.Raw)) - { + Status =3D SafeUintnAdd ((UINTN)Smbios.Raw, sizeof (SMBIOS_STRUCTURE),= &SafeIntResult); + if (EFI_ERROR (Status)) { + return EFI_INVALID_PARAMETER; + } + + if ((SafeIntResult > (UINTN)SmbiosEnd.Raw) || (SafeIntResult < (UINTN)= Smbios.Raw)) { return EFI_INVALID_PARAMETER; } =20 diff --git a/MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.inf b/MdeModulePkg/= Universal/SmbiosDxe/SmbiosDxe.inf index c03915a6921f..8b7c74694775 100644 --- a/MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.inf +++ b/MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.inf @@ -42,6 +42,7 @@ [LibraryClasses] DebugLib PcdLib HobLib + SafeIntLib =20 [Protocols] gEfiSmbiosProtocolGuid ## PRODUCES --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100102): https://edk2.groups.io/g/devel/message/100102 Mute This Topic: https://groups.io/mt/96938294/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100103+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100103+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303387; cv=none; d=zohomail.com; s=zohoarc; b=QWE4jttJ700A9AFkOHPe0yUz8cz4VB+KhQE8G9RWNpBw7ErK/s2Fl+rPKwInUPAtuGQ/Xv+em4VuwLLJZtC0u++MA6NFHktHdKuToEiD3wrgb739NrFoOvcXUjx9schKi1yKhhuIl4fdmdN9t2myu0AToASUiSW1x5b6Vhjeyto= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303387; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=Skmr5Sr4SpOQ42fWoOYAfRHYTKMQewPUsoTphXJxsxw=; b=XjgL+EvBiFAAuProd5wJwqwH2OkJOB1fh+3YwIBnAqAvXApnlzk1+gjmLzOFHHdTP73qb9jezXZsJuUWRnd/cOgWGX+Adtifwv8IBLMN5J6N3ZtX8dPmkeJZgA+KWGG2RNeK/VSW/8iVC6toh3xQlRYzw3H5LQFOGtU5HhKutHc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100103+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303387892953.862026869914; Mon, 13 Feb 2023 07:49:47 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id Qrv6YY1788612xjAUIa3bvGw; Mon, 13 Feb 2023 07:49:47 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web10.17793.1676303386775606498 for ; Mon, 13 Feb 2023 07:49:46 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 58D1820C8B7C; Mon, 13 Feb 2023 07:49:45 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 58D1820C8B7C From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Bob Feng , Liming Gao , Michael D Kinney , Sean Brogan , Yuwei Chen Subject: [edk2-devel] [PATCH v3 02/12] BaseTools/PatchCheck.py: Add PCCTS to tab exemption list Date: Mon, 13 Feb 2023 10:48:58 -0500 Message-Id: <20230213154908.1993-3-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: 8OJ4iPg6qyicw9JztVsGf0gkx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303387; bh=sARWhH4UZyLrKn6Au5E4UigGFB+K9PpBbkCBuZ+A/WA=; h=Cc:Date:From:Reply-To:Subject:To; b=N+0OgFWEsADVct/5mx5yVuEZaFeBbkuMuQ6HrJZ/P5e1S5vxlA6DORjZ/AbeyazOdQc ejJD0Ffq0l3kMYlQLm5MR93FppMRoq2mUr0jcrPx6GMYvMCQhZEnqXPcgxjfVqFw1ERQd EiZvV97N5jeMw2OfWz66V86DzP+Z1c+GQhw= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303388750100002 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki Purdue Compiler Construction Tool Set (PCCTS) source code was copied/ pasted into BaseTools/Source/C/VfrCompile/Pccts/. The code contains tab characters instead of spaces. PatchCheck.py gives an error on modifications to files that contain tabs. This change adds that directory to the pre-existing list of directories in which tab checks are ignored in PatchCheck.py. The goal of my upcoming change there is not to mix tabs and spaces but to fix a bug while preserving its current formatting characters. Cc: Bob Feng Cc: Liming Gao Cc: Michael D Kinney Cc: Sean Brogan Cc: Yuwei Chen Signed-off-by: Michael Kubacki Reviewed-by: Liming Gao Reviewed-by: Michael D Kinney --- BaseTools/Scripts/PatchCheck.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/BaseTools/Scripts/PatchCheck.py b/BaseTools/Scripts/PatchCheck= .py index fcdabfc8acea..84d56b8c8b70 100755 --- a/BaseTools/Scripts/PatchCheck.py +++ b/BaseTools/Scripts/PatchCheck.py @@ -383,7 +383,9 @@ class GitDiffCheck: self.force_crlf =3D False self.force_notabs =3D False if os.path.basename(self.filename) =3D=3D 'GNUmakefile' or= \ - os.path.basename(self.filename) =3D=3D 'Makefile': + os.path.basename(self.filename) =3D=3D 'Makefile' or \ + self.filename.startswith( + 'BaseTools/Source/C/VfrCompile/Pccts/'): self.force_notabs =3D False elif len(line.rstrip()) !=3D 0: self.format_error("didn't find diff command") --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100103): https://edk2.groups.io/g/devel/message/100103 Mute This Topic: https://groups.io/mt/96938296/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100104+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100104+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303391; cv=none; d=zohomail.com; s=zohoarc; b=jLlgIRxqgncBefMJmYs6n8uLcS3uS1UG6D2rVbWJ47Tf4ajIvplLb/EpZ7tX7KwO7cQXZI8gJnJZR+WmNGXxPaYk+J7jFIZVMVkdT521+NJQO5LiBMX0Tb8vjjMBcr/G57AmayN8jPCvJCA4TjP7xF+A+JmlrYg+LCAKE+JozYg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303391; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=2/MaKPgk5PUyPnTte7hawzlYCh9Vq4DmGj2yLHqvRjk=; b=in/bCfNvTJtkR6bxLYxwS6OJFF59Uq2wGYtuWgbkA/OAKQexuVicAMR5IUXrFGUOcMKJ6P8rzW70jwk6/y1UFgvC5fzMqL5vMQBAY95pZBMh65Y6f2g/DAU+vDsalm/ELLihirPuGzsqokNSXQ6b/shyONEscQekDBc8CjqidCU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100104+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303391533724.3587318055945; Mon, 13 Feb 2023 07:49:51 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id Zcx5YY1788612xHKT3NMuMd1; Mon, 13 Feb 2023 07:49:51 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web11.17965.1676303390552465154 for ; Mon, 13 Feb 2023 07:49:50 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 7B07720C8B73; Mon, 13 Feb 2023 07:49:49 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 7B07720C8B73 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Bob Feng , Liming Gao , Michael D Kinney , Sean Brogan , Yuwei Chen Subject: [edk2-devel] [PATCH v3 03/12] BaseTools/VfrCompile: Fix potential buffer overwrites Date: Mon, 13 Feb 2023 10:48:59 -0500 Message-Id: <20230213154908.1993-4-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: NTEJ2FnhOGOos1GkWWzr7I41x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303391; bh=bW27tF3xBi5ulwPNAB/vqnlfLGP5B+4qtFByVpbpfSA=; h=Cc:Date:From:Reply-To:Subject:To; b=MuFpDftee1tquc3pGgkcz643ij4ZVGeLcQNSHEKmWrP0txidOjhNGH/Pe0WCF9JnXn1 1jBXNZJrTTsgi3jUWM98FIc5/yHRaaM+OQsbBdTmgd2xZxQ6DxA6G2b20SPFlfMuWmcWS KVwMnpz/tOBTQQBrrkuYE7bwZvnsKZg9+/4= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303392760100001 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki While more portable methods exist to handle these cases, this change does not attempt to do more than fix the immediate problem and follow the conventions already established in this code. `snprintf()` is introduced as the minimum improvement apart from making the buffers larger. Fixes the following CodeQL alerts: 1. Failure on line 2339 in BaseTools/Source/C/VfrCompile/Pccts/antlr/gen.c - Type: Potentially overrunning write - Severity: Critical - Problem: This 'call to sprintf' operation requires 17 bytes but the destination is only 16 bytes. 2. Failure on line 2341 in BaseTools/Source/C/VfrCompile/Pccts/antlr/gen.c - Type: Potentially overrunning write - Severity: Critical - Problem: This 'call to sprintf' operation requires 17 bytes but the destination is only 16 bytes. 3. Failure on line 1309 in BaseTools/Source/C/VfrCompile/Pccts/antlr/main.c - Type: Potentially overrunning write - Severity: Critical - Problem: This 'call to sprintf' operation requires 25 bytes but the destination is only 20 bytes. Cc: Bob Feng Cc: Liming Gao Cc: Michael D Kinney Cc: Sean Brogan Cc: Yuwei Chen Signed-off-by: Michael Kubacki Reviewed-by: Liming Gao Reviewed-by: Michael D Kinney --- BaseTools/Source/C/VfrCompile/Pccts/antlr/gen.c | 10 +++++----- BaseTools/Source/C/VfrCompile/Pccts/antlr/main.c | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/BaseTools/Source/C/VfrCompile/Pccts/antlr/gen.c b/BaseTools/So= urce/C/VfrCompile/Pccts/antlr/gen.c index 8e41239f4751..33d9cac4c7de 100644 --- a/BaseTools/Source/C/VfrCompile/Pccts/antlr/gen.c +++ b/BaseTools/Source/C/VfrCompile/Pccts/antlr/gen.c @@ -2331,14 +2331,14 @@ TokNode *p; set_nameErrSet =3D bufErrSet; /* MR23 */ } else { /* wild card */ - static char buf[sizeof("zzerr")+10]; - static char bufErrSet[sizeof("zzerr")+10]; + static char buf[sizeof("zzerr")+11]; + static char bufErrSet[sizeof("zzerr")+11]; int n =3D DefErrSet( &b, 0, NULL ); int nErrSet =3D DefErrSetWithSuffix(0, &bErrSet, 1, NULL, "_set"); - if ( GenCC ) sprintf(buf, "err%d", n); - else sprintf(buf, "zzerr%d", n); + if ( GenCC ) snprintf(buf, 11, "err%d", n); + else snprintf(buf, 11, "zzerr%d", n); if ( GenCC ) sprintf(bufErrSet, "err%d", nErrSet); - else sprintf(bufErrSet, "zzerr%d", nErrSet); + else snprintf(bufErrSet, 11, "zzerr%d", nErrSet); set_name =3D buf; set_nameErrSet =3D bufErrSet; } diff --git a/BaseTools/Source/C/VfrCompile/Pccts/antlr/main.c b/BaseTools/S= ource/C/VfrCompile/Pccts/antlr/main.c index 051ee4ec5d28..488b4b90461c 100644 --- a/BaseTools/Source/C/VfrCompile/Pccts/antlr/main.c +++ b/BaseTools/Source/C/VfrCompile/Pccts/antlr/main.c @@ -1295,7 +1295,7 @@ int token; #endif { int j; - static char imag_name[20]; + static char imag_name[25]; =20 /* look in all lexclasses for the token */ if ( TokenString(token) !=3D NULL ) return TokenString(token); @@ -1306,7 +1306,7 @@ int token; } =20 if (1) { - sprintf(imag_name,"UnknownToken#%d",token); /* MR13 */ + snprintf(imag_name, 25, "UnknownToken#%d", token); /* MR13 */ return imag_name; /* MR13 */ } =20 --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100104): https://edk2.groups.io/g/devel/message/100104 Mute This Topic: https://groups.io/mt/96938297/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100105+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100105+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303395; cv=none; d=zohomail.com; s=zohoarc; b=gqTMLBwP1JByCd+GK5m1wx5fHyDJYhF2lCmZ/xZstniU9eTnuS3nGBqvL5SYDZFD4YTZS+2wKIeOlyydB/IHZthn51+96Dm+ZKcXipVpY+J8qkKIZy6PDZAJIwAebtQtfprhjoZsY903jPctHlN59h67DPWxCtaDHq9kDsdng14= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303395; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=DRaZCrh7/zXjBm5wUo9fisEHA6SYCjk5r0fLvZf1d6Y=; b=ItEZEkb8XU7rBsFBhyXDbRD3EAoZeNs1RgnN97B28GHUiafmPBvzzlf/GXf0FiCOaPN2vdPzf2LmEYOWcbtykxrwCUL5FM2LZyEISaU8lEjxUHqRYesSu4l186i/DbokBsrlWsdvMdl4bWIeK/Hik1xcApkqBdm1mRFxg/BRfCs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100105+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303395283333.72609676602974; Mon, 13 Feb 2023 07:49:55 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id 85jaYY1788612xyebi2pANyF; Mon, 13 Feb 2023 07:49:54 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web10.17795.1676303394300183457 for ; Mon, 13 Feb 2023 07:49:54 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 9C6E620C8B7A; Mon, 13 Feb 2023 07:49:52 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 9C6E620C8B7A From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Erich McMillan , Guomin Jiang , Jian J Wang , Jiewen Yao , Michael Kubacki , Xiaoyu Lu , Jiewen Yao Subject: [edk2-devel] [PATCH v3 04/12] CryptoPkg: Fix conditionally uninitialized variable Date: Mon, 13 Feb 2023 10:49:00 -0500 Message-Id: <20230213154908.1993-5-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: uizCad3wsFVwtIDvX2V27jJZx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303394; bh=KWaBJeKHBHS/iMVnngaW/0wUAA9IRQe35edUvC1eEYE=; h=Cc:Date:From:Reply-To:Subject:To; b=ttpH/Uo7Z3C8EFIqb5z7eNddXHpw3em/QBBiExfM7IOVBCPROQzmU8LGcW75xgQLENp OnHlipdTvzdjyz71v3MHoVvKsGijPasZ49jpweVHDOf2V2+6hNXQSpxogs4bw4EcrhY/7 JjC8f6KN1sgqPVpwujfnQUi5IIiP4GH9KYI= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303396784100002 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki Fixes CodeQL alerts for CWE-457: https://cwe.mitre.org/data/definitions/457.html Checks the return value from `ASN1_get_object()` to verify values set by the function are valid. Note that the function returns literal `0x80`: `return (0x80);` That is used to check the return value is as the case in other areas of the code. Cc: Erich McMillan Cc: Guomin Jiang Cc: Jian J Wang Cc: Jiewen Yao Cc: Michael Kubacki Cc: Xiaoyu Lu Co-authored-by: Erich McMillan Signed-off-by: Michael Kubacki Reviewed-by: Jiewen Yao --- CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c | 21 +++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Libr= ary/BaseCryptLib/Pk/CryptX509.c index 2333157e0d17..1182323b63ee 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c @@ -807,6 +807,7 @@ X509GetTBSCert ( UINT32 Asn1Tag; UINT32 ObjClass; UINTN Length; + UINTN Inf; =20 // // Check input parameters. @@ -836,9 +837,9 @@ X509GetTBSCert ( // Temp =3D Cert; Length =3D 0; - ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (int *)&ObjCla= ss, (long)CertSize); + Inf =3D ASN1_get_object (&Temp, (long *)&Length, (int *)&Asn1Tag, (in= t *)&ObjClass, (long)CertSize); =20 - if (Asn1Tag !=3D V_ASN1_SEQUENCE) { + if (((Inf & 0x80) =3D=3D 0x00) && (Asn1Tag !=3D V_ASN1_SEQUENCE)) { return FALSE; } =20 @@ -848,7 +849,7 @@ X509GetTBSCert ( // // Verify the parsed TBSCertificate is one correct SEQUENCE data. // - if (Asn1Tag !=3D V_ASN1_SEQUENCE) { + if (((Inf & 0x80) =3D=3D 0x00) && (Asn1Tag !=3D V_ASN1_SEQUENCE)) { return FALSE; } =20 @@ -1888,18 +1889,20 @@ Asn1GetTag ( IN UINT32 Tag ) { - UINT8 *PtrOld; - INT32 ObjTag; - INT32 ObjCls; - long ObjLength; + UINT8 *PtrOld; + INT32 ObjTag; + INT32 ObjCls; + long ObjLength; + UINT32 Inf; =20 // // Save Ptr position // PtrOld =3D *Ptr; =20 - ASN1_get_object ((CONST UINT8 **)Ptr, &ObjLength, &ObjTag, &ObjCls, (INT= 32)(End - (*Ptr))); - if ((ObjTag =3D=3D (INT32)(Tag & CRYPTO_ASN1_TAG_VALUE_MASK)) && + Inf =3D ASN1_get_object ((CONST UINT8 **)Ptr, &ObjLength, &ObjTag, &ObjC= ls, (INT32)(End - (*Ptr))); + if (((Inf & 0x80) =3D=3D 0x00) && + (ObjTag =3D=3D (INT32)(Tag & CRYPTO_ASN1_TAG_VALUE_MASK)) && (ObjCls =3D=3D (INT32)(Tag & CRYPTO_ASN1_TAG_CLASS_MASK))) { *Length =3D (UINTN)ObjLength; --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100105): https://edk2.groups.io/g/devel/message/100105 Mute This Topic: https://groups.io/mt/96938299/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100106+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100106+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303399; cv=none; d=zohomail.com; s=zohoarc; b=QZfDghrRxDxuUXBJcb70vu6YbpoPy2ehCeRi9vXfLQGEzxb+G4QoVVIqtUPdiWz5R/9VNd+6BIc96vmfC78I0o20Yt/NJn6gZxvVs7kkcgSAwMm4M7X/gGAlZwMBO7rWOV1RLxPlxfVohOnMgGftCYwH8KBRXflUBPj+t5q2jFI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303399; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=dNq6EinTZJkje8TXeQ5qO7H8/U30naaFQbQ8Qu4WTag=; b=QkxtML1F1Q2+DysJ5RLlAo78nswDrn9fAXNbJHWuf+8tU2V05npIe2E1KYJZDdgK6eSQZM9faQyWBwEF8ab1M4YAsRuDcGgHMn8PZfm7dGtbPuRwDGEp5M/yRcVlq0IJXUcJd27/X2pqUV7AQZyKFCH2j78JRhw6DHDH3ysQOPA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100106+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303398835805.1804991879301; Mon, 13 Feb 2023 07:49:58 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id WaBrYY1788612xEzkyWnp6e8; Mon, 13 Feb 2023 07:49:58 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web11.17969.1676303397805643375 for ; Mon, 13 Feb 2023 07:49:57 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 3DC9020C8B7C; Mon, 13 Feb 2023 07:49:56 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 3DC9020C8B7C From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Dandan Bi , Eric Dong , Erich McMillan , Guomin Jiang , Jian J Wang , Liming Gao , Michael Kubacki , Ray Ni , Zhichao Gao Subject: [edk2-devel] [PATCH v3 05/12] MdeModulePkg: Fix conditionally uninitialized variables Date: Mon, 13 Feb 2023 10:49:01 -0500 Message-Id: <20230213154908.1993-6-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: lPknX0TklYHQxMtRdrz7wD4Cx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303398; bh=/BhGr+rZyMYNQzlKPwK8/429yjgQzUuBWhQ/rZocDiI=; h=Cc:Date:From:Reply-To:Subject:To; b=TfLDMbxfQjOVlkF2sMrPo/Ga/NPp0udrFSlkDaiSTgaDsxEa3Y2r6s46ucxK2yJZDYI k9YACwnc/WUC0N5HJP0GTnGQ767G7JiGSct8Au9G3/Ow8gpkjUQ2EkdBUBxho+/NUvWqi v6dnlhPrLDa3NXyf+hQBFs4bI9lcjINowKw= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303400890100002 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki Fixes CodeQL alerts for CWE-457: https://cwe.mitre.org/data/definitions/457.html Cc: Dandan Bi Cc: Eric Dong Cc: Erich McMillan Cc: Guomin Jiang Cc: Jian J Wang Cc: Liming Gao Cc: Michael Kubacki Cc: Ray Ni Cc: Zhichao Gao Co-authored-by: Erich McMillan Signed-off-by: Michael Kubacki Reviewed-by: Liming Gao --- MdeModulePkg/Bus/Pci/PciBusDxe/PciIo.c | 5 +-- MdeModulePkg/Bus/Pci/UhciDxe/Uhci.c | 24 +++++++= +------ MdeModulePkg/Core/Dxe/Mem/Page.c | 17 +++++--= --- MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootOption.c | 25 +++++++= ++------ MdeModulePkg/Library/FileExplorerLib/FileExplorer.c | 5 ++- MdeModulePkg/Universal/BdsDxe/BdsEntry.c | 33 +++++++= ++++--------- MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c | 11 ++++--- MdeModulePkg/Universal/HiiDatabaseDxe/Font.c | 14 ++++++-= -- MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 2 +- 9 files changed, 80 insertions(+), 56 deletions(-) diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciIo.c b/MdeModulePkg/Bus/Pci/= PciBusDxe/PciIo.c index 843815d0cb18..14bed5472958 100644 --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciIo.c +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciIo.c @@ -1407,6 +1407,7 @@ SupportPaletteSnoopAttributes ( IN EFI_PCI_IO_PROTOCOL_ATTRIBUTE_OPERATION Operation ) { + EFI_STATUS Status; PCI_IO_DEVICE *Temp; UINT16 VGACommand; =20 @@ -1444,13 +1445,13 @@ SupportPaletteSnoopAttributes ( // Check if they are on the same bus // if (Temp->Parent =3D=3D PciIoDevice->Parent) { - PCI_READ_COMMAND_REGISTER (Temp, &VGACommand); + Status =3D PCI_READ_COMMAND_REGISTER (Temp, &VGACommand); =20 // // If they are on the same bus, either one can // be set to snoop, the other set to decode // - if ((VGACommand & EFI_PCI_COMMAND_VGA_PALETTE_SNOOP) !=3D 0) { + if (!EFI_ERROR (Status) && ((VGACommand & EFI_PCI_COMMAND_VGA_PALETTE_= SNOOP) !=3D 0)) { // // VGA has set to snoop, so GFX can be only set to disable snoop // diff --git a/MdeModulePkg/Bus/Pci/UhciDxe/Uhci.c b/MdeModulePkg/Bus/Pci/Uhc= iDxe/Uhci.c index 48741085e507..496ffbd5c4cc 100644 --- a/MdeModulePkg/Bus/Pci/UhciDxe/Uhci.c +++ b/MdeModulePkg/Bus/Pci/UhciDxe/Uhci.c @@ -730,10 +730,12 @@ Uhci2ControlTransfer ( =20 Uhc->PciIo->Flush (Uhc->PciIo); =20 - *TransferResult =3D QhResult.Result; + if (!EFI_ERROR (Status)) { + *TransferResult =3D QhResult.Result; =20 - if (DataLength !=3D NULL) { - *DataLength =3D QhResult.Complete; + if (DataLength !=3D NULL) { + *DataLength =3D QhResult.Complete; + } } =20 UhciDestoryTds (Uhc, TDs); @@ -884,9 +886,11 @@ Uhci2BulkTransfer ( =20 Uhc->PciIo->Flush (Uhc->PciIo); =20 - *TransferResult =3D QhResult.Result; - *DataToggle =3D QhResult.NextToggle; - *DataLength =3D QhResult.Complete; + if (!EFI_ERROR (Status)) { + *TransferResult =3D QhResult.Result; + *DataToggle =3D QhResult.NextToggle; + *DataLength =3D QhResult.Complete; + } =20 UhciDestoryTds (Uhc, TDs); Uhc->PciIo->Unmap (Uhc->PciIo, DataMap); @@ -1210,9 +1214,11 @@ Uhci2SyncInterruptTransfer ( UhciUnlinkTdFromQh (Uhc->SyncIntQh, TDs); Uhc->PciIo->Flush (Uhc->PciIo); =20 - *TransferResult =3D QhResult.Result; - *DataToggle =3D QhResult.NextToggle; - *DataLength =3D QhResult.Complete; + if (!EFI_ERROR (Status)) { + *TransferResult =3D QhResult.Result; + *DataToggle =3D QhResult.NextToggle; + *DataLength =3D QhResult.Complete; + } =20 UhciDestoryTds (Uhc, TDs); Uhc->PciIo->Unmap (Uhc->PciIo, DataMap); diff --git a/MdeModulePkg/Core/Dxe/Mem/Page.c b/MdeModulePkg/Core/Dxe/Mem/P= age.c index 5903ce7ab525..41af50b3d5ab 100644 --- a/MdeModulePkg/Core/Dxe/Mem/Page.c +++ b/MdeModulePkg/Core/Dxe/Mem/Page.c @@ -449,14 +449,15 @@ PromoteMemoryResource ( // Promoted =3D PromoteGuardedFreePages (&StartAddress, &EndAddress); if (Promoted) { - CoreGetMemorySpaceDescriptor (StartAddress, &Descriptor); - CoreAddRange ( - EfiConventionalMemory, - StartAddress, - EndAddress, - Descriptor.Capabilities & ~(EFI_MEMORY_PRESENT | EFI_MEMORY_INITIA= LIZED | - EFI_MEMORY_TESTED | EFI_MEMORY_RUNTIME) - ); + if (!EFI_ERROR (CoreGetMemorySpaceDescriptor (StartAddress, &Descrip= tor))) { + CoreAddRange ( + EfiConventionalMemory, + StartAddress, + EndAddress, + Descriptor.Capabilities & ~(EFI_MEMORY_PRESENT | EFI_MEMORY_INIT= IALIZED | + EFI_MEMORY_TESTED | EFI_MEMORY_RUNTI= ME) + ); + } } } =20 diff --git a/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootOption.c = b/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootOption.c index cdaa2db15365..e22aaf3039f1 100644 --- a/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootOption.c +++ b/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootOption.c @@ -909,23 +909,28 @@ BootFromFile ( IN EFI_DEVICE_PATH_PROTOCOL *FilePath ) { + EFI_STATUS Status; EFI_BOOT_MANAGER_LOAD_OPTION BootOption; CHAR16 *FileName; =20 + Status =3D EFI_NOT_STARTED; FileName =3D NULL; =20 FileName =3D ExtractFileNameFromDevicePath (FilePath); if (FileName !=3D NULL) { - EfiBootManagerInitializeLoadOption ( - &BootOption, - 0, - LoadOptionTypeBoot, - LOAD_OPTION_ACTIVE, - FileName, - FilePath, - NULL, - 0 - ); + Status =3D EfiBootManagerInitializeLoadOption ( + &BootOption, + 0, + LoadOptionTypeBoot, + LOAD_OPTION_ACTIVE, + FileName, + FilePath, + NULL, + 0 + ); + } + + if (!EFI_ERROR (Status)) { // // Since current no boot from removable media directly is allowed */ // diff --git a/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c b/MdeModul= ePkg/Library/FileExplorerLib/FileExplorer.c index ef949267fcc2..804a03d868f2 100644 --- a/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c +++ b/MdeModulePkg/Library/FileExplorerLib/FileExplorer.c @@ -1075,7 +1075,10 @@ LibCreateNewFile ( NewHandle =3D NULL; FullFileName =3D NULL; =20 - LibGetFileHandleFromDevicePath (gFileExplorerPrivate.RetDevicePath, &Fil= eHandle, &ParentName, &DeviceHandle); + if (EFI_ERROR (LibGetFileHandleFromDevicePath (gFileExplorerPrivate.RetD= evicePath, &FileHandle, &ParentName, &DeviceHandle))) { + return EFI_DEVICE_ERROR; + } + FullFileName =3D LibAppendFileName (ParentName, FileName); if (FullFileName =3D=3D NULL) { return EFI_OUT_OF_RESOURCES; diff --git a/MdeModulePkg/Universal/BdsDxe/BdsEntry.c b/MdeModulePkg/Univer= sal/BdsDxe/BdsEntry.c index 766dde3aaeeb..72de8d3211b7 100644 --- a/MdeModulePkg/Universal/BdsDxe/BdsEntry.c +++ b/MdeModulePkg/Universal/BdsDxe/BdsEntry.c @@ -691,6 +691,7 @@ BdsEntry ( EFI_DEVICE_PATH_PROTOCOL *FilePath; EFI_STATUS BootManagerMenuStatus; EFI_BOOT_MANAGER_LOAD_OPTION PlatformDefaultBootOption; + BOOLEAN PlatformDefaultBootOptionValid; =20 HotkeyTriggered =3D NULL; Status =3D EFI_SUCCESS; @@ -809,24 +810,24 @@ BdsEntry ( CpuDeadLoop (); } =20 - Status =3D EfiBootManagerInitializeLoadOption ( - &PlatformDefaultBootOption, - LoadOptionNumberUnassigned, - LoadOptionTypePlatformRecovery, - LOAD_OPTION_ACTIVE, - L"Default PlatformRecovery", - FilePath, - NULL, - 0 - ); - ASSERT_EFI_ERROR (Status); + PlatformDefaultBootOptionValid =3D EfiBootManagerInitializeLoadOption ( + &PlatformDefaultBootOption, + LoadOptionNumberUnassigned, + LoadOptionTypePlatformRecovery, + LOAD_OPTION_ACTIVE, + L"Default PlatformRecovery", + FilePath, + NULL, + 0 + ) =3D=3D EFI_SUCCESS; + ASSERT (PlatformDefaultBootOptionValid =3D=3D TRUE); =20 // // System firmware must include a PlatformRecovery#### variable specifyi= ng // a short-form File Path Media Device Path containing the platform defa= ult // file path for removable media if the platform supports Platform Recov= ery. // - if (PcdGetBool (PcdPlatformRecoverySupport)) { + if (PlatformDefaultBootOptionValid && PcdGetBool (PcdPlatformRecoverySup= port)) { LoadOptions =3D EfiBootManagerGetLoadOptions (&LoadOptionCount, LoadOp= tionTypePlatformRecovery); if (EfiBootManagerFindLoadOption (&PlatformDefaultBootOption, LoadOpti= ons, LoadOptionCount) =3D=3D -1) { for (Index =3D 0; Index < LoadOptionCount; Index++) { @@ -1104,15 +1105,17 @@ BdsEntry ( LoadOptions =3D EfiBootManagerGetLoadOptions (&LoadOptionCount, Load= OptionTypePlatformRecovery); ProcessLoadOptions (LoadOptions, LoadOptionCount); EfiBootManagerFreeLoadOptions (LoadOptions, LoadOptionCount); - } else { + } else if (PlatformDefaultBootOptionValid) { // // When platform recovery is not enabled, still boot to platform def= ault file path. // - EfiBootManagerProcessLoadOption (&PlatformDefaultBootOption); + PlatformDefaultBootOptionValid =3D EfiBootManagerProcessLoadOption (= &PlatformDefaultBootOption) =3D=3D EFI_SUCCESS; } } =20 - EfiBootManagerFreeLoadOption (&PlatformDefaultBootOption); + if (PlatformDefaultBootOptionValid) { + EfiBootManagerFreeLoadOption (&PlatformDefaultBootOption); + } =20 DEBUG ((DEBUG_ERROR, "[Bds] Unable to boot!\n")); PlatformBootManagerUnableToBoot (); diff --git a/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c b/Mde= ModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c index dca3c1df07ba..0d4cfa4cf06f 100644 --- a/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c +++ b/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c @@ -944,13 +944,14 @@ PrintMismatchMenuInfo ( UINTN FormsetBufferSize; =20 Question =3D MenuOption->ThisTag; - HiiGetFormSetFromHiiHandle (gFormData->HiiHandle, &FormsetBuffer, &Forms= etBufferSize); =20 - FormSetTitleStr =3D GetToken (FormsetBuffer->FormSetTitle, gFormData->Hi= iHandle); - FormTitleStr =3D GetToken (gFormData->FormTitle, gFormData->HiiHandle= ); + if (!EFI_ERROR (HiiGetFormSetFromHiiHandle (gFormData->HiiHandle, &Forms= etBuffer, &FormsetBufferSize))) { + FormSetTitleStr =3D GetToken (FormsetBuffer->FormSetTitle, gFormData->= HiiHandle); + FormTitleStr =3D GetToken (gFormData->FormTitle, gFormData->HiiHand= le); =20 - DEBUG ((DEBUG_ERROR, "\n[%a]: Mismatch Formset : Formset Guid =3D %g,= FormSet title =3D %s\n", gEfiCallerBaseName, &gFormData->FormSetGuid, For= mSetTitleStr)); - DEBUG ((DEBUG_ERROR, "[%a]: Mismatch Form : FormId =3D %d, Form t= itle =3D %s.\n", gEfiCallerBaseName, gFormData->FormId, FormTitleStr)); + DEBUG ((DEBUG_ERROR, "\n[%a]: Mismatch Formset : Formset Guid =3D %= g, FormSet title =3D %s\n", gEfiCallerBaseName, &gFormData->FormSetGuid, F= ormSetTitleStr)); + DEBUG ((DEBUG_ERROR, "[%a]: Mismatch Form : FormId =3D %d, Form= title =3D %s.\n", gEfiCallerBaseName, gFormData->FormId, FormTitleStr)); + } =20 if (Question->OpCode->OpCode =3D=3D EFI_IFR_ORDERED_LIST_OP) { QuestionName =3D GetToken (((EFI_IFR_ORDERED_LIST *)MenuOption->ThisTa= g->OpCode)->Question.Header.Prompt, gFormData->HiiHandle); diff --git a/MdeModulePkg/Universal/HiiDatabaseDxe/Font.c b/MdeModulePkg/Un= iversal/HiiDatabaseDxe/Font.c index 399f90feb783..8a0b12f72fbe 100644 --- a/MdeModulePkg/Universal/HiiDatabaseDxe/Font.c +++ b/MdeModulePkg/Universal/HiiDatabaseDxe/Font.c @@ -1745,6 +1745,7 @@ HiiStringToImage ( Attributes =3D (UINT8 *)AllocateZeroPool (StrLength * sizeof (UINT8)); ASSERT (Attributes !=3D NULL); =20 + FontInfo =3D NULL; RowInfo =3D NULL; Status =3D EFI_SUCCESS; StringIn2 =3D NULL; @@ -1787,11 +1788,14 @@ HiiStringToImage ( Background =3D ((EFI_FONT_DISPLAY_INFO *)StringInfo)->BackgroundCol= or; } else if (Status =3D=3D EFI_SUCCESS) { FontInfo =3D &StringInfoOut->FontInfo; - IsFontInfoExisted (Private, FontInfo, NULL, NULL, &GlobalFont); - Height =3D GlobalFont->FontPackage->Height; - BaseLine =3D GlobalFont->FontPackage->BaseLine; - Foreground =3D StringInfoOut->ForegroundColor; - Background =3D StringInfoOut->BackgroundColor; + if (IsFontInfoExisted (Private, FontInfo, NULL, NULL, &GlobalFont)) { + Height =3D GlobalFont->FontPackage->Height; + BaseLine =3D GlobalFont->FontPackage->BaseLine; + Foreground =3D StringInfoOut->ForegroundColor; + Background =3D StringInfoOut->BackgroundColor; + } else { + goto Exit; + } } else { goto Exit; } diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeMod= ulePkg/Universal/Variable/RuntimeDxe/Variable.c index 6c1a3440ac8c..b64fcbdc7281 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c @@ -2453,7 +2453,7 @@ VariableServiceGetVariable ( AcquireLockOnlyAtBootTime (&mVariableModuleGlobal->VariableGlobal.Variab= leServicesLock); =20 Status =3D FindVariable (VariableName, VendorGuid, &Variable, &mVariable= ModuleGlobal->VariableGlobal, FALSE); - if ((Variable.CurrPtr =3D=3D NULL) || EFI_ERROR (Status)) { + if (EFI_ERROR (Status) || (Variable.CurrPtr =3D=3D NULL)) { goto Done; } =20 --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100106): https://edk2.groups.io/g/devel/message/100106 Mute This Topic: https://groups.io/mt/96938300/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100107+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100107+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303405; cv=none; d=zohomail.com; s=zohoarc; b=hXDy7ge0zufhXTkVYofDzMPItWISkAxbiyVcij1+BHdLpAua+OSQR/KvNsMKX1uadzjjKcUfPc1xH0xIwHQZVn51N/UYbOItT8DDdQR0wEgW76A0SpDAMczMKbw7PaDX9Qqr54zmx6BrO9NgxVvOE1m5wvxGs+5nCAxYbV/GfeQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303405; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=R9i+Or5sSt3p3mMF6tBdY57eSfLzyBwyy7cIti7ZhhA=; b=NSWcBNTJs4+q4EZwimhBwt/Ewk4yxxeN8xEblwXs/grgTo5Psrdl8uld5GxQEc4KLEgJw54vihcGie3phySwFEDp+gyE+RrRY/tPEMjJFQ3FpOujEpsFySdhMHok+O/XFEMmQZpPME1loWaqWjboEzJVAR/m6cR/NIofFYqcc4g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100107+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303405286643.7867883785386; Mon, 13 Feb 2023 07:50:05 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id WQh6YY1788612xOregmHErNa; Mon, 13 Feb 2023 07:50:03 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web10.17800.1676303401357502586 for ; Mon, 13 Feb 2023 07:50:01 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 572F020C8B73; Mon, 13 Feb 2023 07:50:00 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 572F020C8B73 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Erich McMillan , Liming Gao , Michael D Kinney , Michael Kubacki , Zhiguang Liu Subject: [edk2-devel] [PATCH v3 06/12] MdePkg: Fix conditionally uninitialized variables Date: Mon, 13 Feb 2023 10:49:02 -0500 Message-Id: <20230213154908.1993-7-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: TeGVyGGpZ8JsebFUiF47sGugx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303403; bh=jAaPoRsq+WQSMVlegpTUE439+woQEaqIlIlN7+YglCU=; h=Cc:Date:From:Reply-To:Subject:To; b=jr8E0bKGmUp9s4XbKrciGQ41nibsfGavIaTSkUja+tFkXES8TDO2Y77d0zjPeiHFOO8 A46OydHi6JblOuMp7/LFnImqCL+lXd24Pg+bM8uym7RLfhi+v7JENBu2wKPhGxvfRHKIs OKr7jEc55tGsCznLnE4IAfiVgNvo2bD11xs= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303406868100002 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki Fixes CodeQL alerts for CWE-457: https://cwe.mitre.org/data/definitions/457.html Note that this change affects the actual return value from the following functions. The functions documented that if an integer overflow occurred, MAX_UINTN would be returned. They were implemented to actually return an undefined value from the stack. This change makes the function follow its description. However, this is technically different than what callers may have previously expected. MdePkg/Library/BaseLib/String.c: - StrDecimalToUintn() - StrDecimalToUint64() - StrHexToUintn() - StrHexToUint64() - AsciiStrDecimalToUintn() - AsciiStrDecimalToUint64() - AsciiStrHexToUintn() - AsciiStrHexToUint64() Cc: Erich McMillan Cc: Liming Gao Cc: Michael D Kinney Cc: Michael Kubacki Cc: Zhiguang Liu Co-authored-by: Erich McMillan Signed-off-by: Michael Kubacki Reviewed-by: Liming Gao --- MdePkg/Library/BaseLib/String.c | 40 ++++++++++++++++---- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/MdePkg/Library/BaseLib/String.c b/MdePkg/Library/BaseLib/Strin= g.c index 98e6d31463e0..637c96e7b31b 100644 --- a/MdePkg/Library/BaseLib/String.c +++ b/MdePkg/Library/BaseLib/String.c @@ -408,7 +408,10 @@ StrDecimalToUintn ( { UINTN Result; =20 - StrDecimalToUintnS (String, (CHAR16 **)NULL, &Result); + if (RETURN_ERROR (StrDecimalToUintnS (String, (CHAR16 **)NULL, &Result))= ) { + return MAX_UINTN; + } + return Result; } =20 @@ -454,7 +457,10 @@ StrDecimalToUint64 ( { UINT64 Result; =20 - StrDecimalToUint64S (String, (CHAR16 **)NULL, &Result); + if (RETURN_ERROR (StrDecimalToUint64S (String, (CHAR16 **)NULL, &Result)= )) { + return MAX_UINT64; + } + return Result; } =20 @@ -501,7 +507,10 @@ StrHexToUintn ( { UINTN Result; =20 - StrHexToUintnS (String, (CHAR16 **)NULL, &Result); + if (RETURN_ERROR (StrHexToUintnS (String, (CHAR16 **)NULL, &Result))) { + return MAX_UINTN; + } + return Result; } =20 @@ -548,7 +557,10 @@ StrHexToUint64 ( { UINT64 Result; =20 - StrHexToUint64S (String, (CHAR16 **)NULL, &Result); + if (RETURN_ERROR (StrHexToUint64S (String, (CHAR16 **)NULL, &Result))) { + return MAX_UINT64; + } + return Result; } =20 @@ -989,7 +1001,10 @@ AsciiStrDecimalToUintn ( { UINTN Result; =20 - AsciiStrDecimalToUintnS (String, (CHAR8 **)NULL, &Result); + if (RETURN_ERROR (AsciiStrDecimalToUintnS (String, (CHAR8 **)NULL, &Resu= lt))) { + return MAX_UINTN; + } + return Result; } =20 @@ -1031,7 +1046,10 @@ AsciiStrDecimalToUint64 ( { UINT64 Result; =20 - AsciiStrDecimalToUint64S (String, (CHAR8 **)NULL, &Result); + if (RETURN_ERROR (AsciiStrDecimalToUint64S (String, (CHAR8 **)NULL, &Res= ult))) { + return MAX_UINT64; + } + return Result; } =20 @@ -1077,7 +1095,10 @@ AsciiStrHexToUintn ( { UINTN Result; =20 - AsciiStrHexToUintnS (String, (CHAR8 **)NULL, &Result); + if (RETURN_ERROR (AsciiStrHexToUintnS (String, (CHAR8 **)NULL, &Result))= ) { + return MAX_UINTN; + } + return Result; } =20 @@ -1123,7 +1144,10 @@ AsciiStrHexToUint64 ( { UINT64 Result; =20 - AsciiStrHexToUint64S (String, (CHAR8 **)NULL, &Result); + if (RETURN_ERROR (AsciiStrHexToUint64S (String, (CHAR8 **)NULL, &Result)= )) { + return MAX_UINT64; + } + return Result; } =20 --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100107): https://edk2.groups.io/g/devel/message/100107 Mute This Topic: https://groups.io/mt/96938302/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100108+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100108+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303585; cv=none; d=zohomail.com; s=zohoarc; b=CcxCo1SRxwovv84IeYkKyslpb+e+tW04eY3+VMslzKCtp/QJqg7SJKS4JdLfLhaCpZAZgeXNgdl80IXQYZNCSWIkI4juYrvpBu5y1RJkB5FNfYzLF2CtRviwQSamM7vGYxSBAhNXj+l+Tgj06iPlHmqx4ZiwMDWngAI7CVl4MZA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303585; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=0HK1XG33w6JcQ97H3jQ3LP4Uw6mqu/Wy6UZdKwlYn8E=; b=VcvQTTcXwWUPoEb/DwrWtDLGZ4uwSm+BxfzyHpHJD8R5zuvHL7eruHPnks7KR8r0trqVux/tBHVBhVu6Q2hmgjtuC6XZmhnOhpWVrogJ5rZpFrfVhOLvF1mZoGJUqZUBYDxSqCYZXj1ikvXXINQK81rf2j/An6TcD1cA3QJTyhU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100108+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303585324806.0445035829823; Mon, 13 Feb 2023 07:53:05 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id TJhaYY1788612xIpu4sePbWe; Mon, 13 Feb 2023 07:53:05 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web11.17975.1676303405294738078 for ; Mon, 13 Feb 2023 07:50:05 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id EDF4B20C8B77; Mon, 13 Feb 2023 07:50:03 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com EDF4B20C8B77 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Erich McMillan , Jiaxin Wu , Maciej Rabeda , Michael D Kinney , Michael Kubacki , Siyuan Fu Subject: [edk2-devel] [PATCH v3 07/12] NetworkPkg: Fix conditionally uninitialized variables Date: Mon, 13 Feb 2023 10:49:03 -0500 Message-Id: <20230213154908.1993-8-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: ASPHnJtmuK8jGWur1zs4J253x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303585; bh=y898JKuUvfDF3XpnF1yPf5A49cNxALvTtjE4r6Zy63k=; h=Cc:Date:From:Reply-To:Subject:To; b=IblclhJ14Rh1IOT5QmAldmdJeBcnUPBHM7yLe4ZMYZ4LXJxH+EI7GBbtaCYXd3203OG lsUDo+z1zINHD7M2bAL3iJWkgUwFuUIBNlYa9QBxEw/5Wd8Ab5/18ck35ZlpZbI4IPkEb pPcP5THhHIAnScpcxWeruEqJFuvXy3CxFiI= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303586674100001 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki Fixes CodeQL alerts for CWE-457: https://cwe.mitre.org/data/definitions/457.html Cc: Erich McMillan Cc: Jiaxin Wu Cc: Maciej Rabeda Cc: Michael D Kinney Cc: Michael Kubacki Cc: Siyuan Fu Co-authored-by: Erich McMillan Signed-off-by: Michael Kubacki --- NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c | 2 +- NetworkPkg/TcpDxe/TcpInput.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c b/NetworkPkg/Librar= y/DxeHttpLib/DxeHttpLib.c index 6a5d78629bb3..21813463aa4f 100644 --- a/NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c +++ b/NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c @@ -753,7 +753,7 @@ HttpUrlGetPort ( =20 Status =3D AsciiStrDecimalToUintnS (Url + Parser->FieldData[HTTP_URI_FI= ELD_PORT].Offset, (CHAR8 **)NULL, &Data); =20 - if (Data > HTTP_URI_PORT_MAX_NUM) { + if (EFI_ERROR (Status) || (Data > HTTP_URI_PORT_MAX_NUM)) { Status =3D EFI_INVALID_PARAMETER; goto ON_EXIT; } diff --git a/NetworkPkg/TcpDxe/TcpInput.c b/NetworkPkg/TcpDxe/TcpInput.c index fb1aa827f8ba..7b329be64dfe 100644 --- a/NetworkPkg/TcpDxe/TcpInput.c +++ b/NetworkPkg/TcpDxe/TcpInput.c @@ -1570,6 +1570,9 @@ TcpIcmpInput ( BOOLEAN IcmpErrIsHard; BOOLEAN IcmpErrNotify; =20 + IcmpErrIsHard =3D FALSE; + IcmpErrNotify =3D FALSE; + if (Nbuf->TotalSize < sizeof (TCP_HEAD)) { goto CLEAN_EXIT; } --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100108): https://edk2.groups.io/g/devel/message/100108 Mute This Topic: https://groups.io/mt/96938305/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100109+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100109+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303409; cv=none; d=zohomail.com; s=zohoarc; b=UomQl5e+agmtde3AWIk1GUyWDuCJHfnUiMY5UrHOIu+zUT2ZUB52iQHPEKsru9fdeAvB2MLBJbnIhNnfkY+GPG8g87EfycW2idDF4/sOkd9AL3DBFUbD2uRkauMBwr4feXvUXxYFSbXu1CBH0XvPkYgdhn9tIlBea0aNamTGR7M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303409; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=UIqkbUTsk3UOkbEzeLejLUHV3hGmCMc3z+DlJw6mefM=; b=ESk5kFuM5uyREorWe9OCDCcl9eRmqUSC0eQMJBCj2CGzrQ2kspDn/NPH70rJWiwpuG0Ec21MrmuHeCzbLjlwlLdhRFSSRS860+YABS58/WJxVtFqFkyRaCAQsO2qAs3b//Get8Zi6Cp+DyIFbnE0HJBSBbRdsbCU45GcTU0gD+w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100109+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303409228148.27582607425597; Mon, 13 Feb 2023 07:50:09 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id GYcMYY1788612x5NqtWPTyCC; Mon, 13 Feb 2023 07:50:08 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web10.17809.1676303408337343584 for ; Mon, 13 Feb 2023 07:50:08 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 655F920C8B73; Mon, 13 Feb 2023 07:50:07 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 655F920C8B73 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Erich McMillan , Michael D Kinney , Michael Kubacki , Ray Ni Subject: [edk2-devel] [PATCH v3 08/12] PcAtChipsetPkg: Fix conditionally uninitialized variables Date: Mon, 13 Feb 2023 10:49:04 -0500 Message-Id: <20230213154908.1993-9-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: ZNS2sMnpJViKm5ieeLxP2egPx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303408; bh=v/zYQrnwwqAqYoF4lyAWag7aWpWAt+yQnLTuRYI+tEw=; h=Cc:Date:From:Reply-To:Subject:To; b=pJBxh0Qp4Ngp0k+pKLGvuPZKM8KgUxdOg4BR50vlPzPuofqTW9jRyYSgcKzvoPf5KHH Fveh4cenLmg4eSmEuq2fwfaG+yqbbHQYg7FgDhrT4VLweSSDAQljExmgzosTnkXHtd9I8 KCUeiZ3mc2NK+cYTkiObnLQu79z3tS9F0p4= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303410875100001 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki Fixes CodeQL alerts for CWE-457: https://cwe.mitre.org/data/definitions/457.html Cc: Erich McMillan Cc: Michael D Kinney Cc: Michael Kubacki Cc: Ray Ni Co-authored-by: Erich McMillan Signed-off-by: Michael Kubacki Reviewed-by: Michael D Kinney Reviewed-by: Ray Ni --- PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcRtc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcRtc.c b/PcAtChips= etPkg/PcatRealTimeClockRuntimeDxe/PcRtc.c index 9242a2e82600..57ea3153aa6b 100644 --- a/PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcRtc.c +++ b/PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcRtc.c @@ -344,7 +344,7 @@ PcRtcInit ( // so we can use them to get and set wakeup time. // Status =3D PcRtcGetWakeupTime (&Enabled, &Pending, &Time, Global); - if ((Enabled) || (!EFI_ERROR (Status))) { + if ((!EFI_ERROR (Status)) || (Enabled)) { return EFI_SUCCESS; } =20 @@ -836,8 +836,11 @@ PcRtcSetWakeupTime ( // // Just support set alarm time within 24 hours // - PcRtcGetTime (&RtcTime, &Capabilities, Global); - Status =3D RtcTimeFieldsValid (&RtcTime); + Status =3D PcRtcGetTime (&RtcTime, &Capabilities, Global); + if (!EFI_ERROR (Status)) { + Status =3D RtcTimeFieldsValid (&RtcTime); + } + if (EFI_ERROR (Status)) { return EFI_DEVICE_ERROR; } --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100109): https://edk2.groups.io/g/devel/message/100109 Mute This Topic: https://groups.io/mt/96938310/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100110+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100110+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303415; cv=none; d=zohomail.com; s=zohoarc; b=Y3Ni6WCSVr4/VOKhKN/989t58hpGr/4gTPHO0Te9e+CjhwyYn/i0PKx2vlNhYTv9RnNIisunpvSZKHh6Xr7qkx/BZSF++JY4S/F7nnoviY3Wt5jRENt1Hmd2oZsf12mRaI6j6cbmIPCQRdSkckXpLaUqJ7pqfrP1wBPCwckr2XA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303415; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=EKohg/njNqKlrsr2BN184yaQZWs6eMODK2LCtXxzwrM=; b=IJ69TyN9HyCKdNN/74BoNjg4fxr4rDCtOgBm92TSviljCaSS4qXWOwidgxP8ySwkoS0PfcigaOKw6lz8zgAAMxEpcL237tETKEseu4/eVGnJlFCvBhBaeBU3vOcFltUWcG7jQnb3SGdz/UPeFl2ZGsnpXOG26UqHkGTKeC5rezU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100110+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303415234604.234552759949; Mon, 13 Feb 2023 07:50:15 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id HxECYY1788612xfP4KeFzwOd; Mon, 13 Feb 2023 07:50:12 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web10.17812.1676303411588074215 for ; Mon, 13 Feb 2023 07:50:11 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 8F99320C8B73; Mon, 13 Feb 2023 07:50:10 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 8F99320C8B73 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Erich McMillan , Michael D Kinney , Michael Kubacki , Ray Ni , Zhichao Gao Subject: [edk2-devel] [PATCH v3 09/12] ShellPkg: Fix conditionally uninitialized variables Date: Mon, 13 Feb 2023 10:49:05 -0500 Message-Id: <20230213154908.1993-10-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: K5meojxVK1dZ9CuFiYy1sIVAx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303412; bh=+a7qNiBs5sFDwoFSHTOQOgi9rYD3304ar9AsljPfKV4=; h=Cc:Date:From:Reply-To:Subject:To; b=p6OdpnkjdZiIWoQebs25mZw+4/VBLB3FaebSKNPa7lDyCovl1BgbbQYStWazRCxjtCJ 0ZhSDiPoKdIe/wy9YvZKJoUj2AV1Wc977jvXjHNRUIp1hveMfvOvu0AjjwfzU8gotRzNI g7IiZiYm1nUxZQAoBg5qZx5ZaqZpen5J9u0= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303416961100003 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki Fixes CodeQL alerts for CWE-457: https://cwe.mitre.org/data/definitions/457.html Cc: Erich McMillan Cc: Michael D Kinney Cc: Michael Kubacki Cc: Ray Ni Cc: Zhichao Gao Co-authored-by: Erich McMillan Signed-off-by: Michael Kubacki Reviewed-by: Zhichao Gao --- ShellPkg/Application/Shell/Shell.c | 1 + ShellPkg/Application/Shell/ShellProtocol.c | 60 +++++++++= +---------- ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.c | 56 +++++++++= --------- ShellPkg/Library/UefiShellDebug1CommandsLib/Dblk.c | 18 +++--- ShellPkg/Library/UefiShellDebug1CommandsLib/EfiDecompress.c | 9 ++- ShellPkg/Library/UefiShellDriver1CommandsLib/Connect.c | 14 +++-- ShellPkg/Library/UefiShellDriver1CommandsLib/Disconnect.c | 17 ++++-- ShellPkg/Library/UefiShellDriver1CommandsLib/DrvDiag.c | 21 +++---- 8 files changed, 107 insertions(+), 89 deletions(-) diff --git a/ShellPkg/Application/Shell/Shell.c b/ShellPkg/Application/Shel= l/Shell.c index 0ae6e14a34bf..f95c799bb2a4 100644 --- a/ShellPkg/Application/Shell/Shell.c +++ b/ShellPkg/Application/Shell/Shell.c @@ -1300,6 +1300,7 @@ DoStartupScript ( CHAR16 *FullFileStringPath; UINTN NewSize; =20 + CalleeStatus =3D EFI_SUCCESS; Key.UnicodeChar =3D CHAR_NULL; Key.ScanCode =3D 0; =20 diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Applicat= ion/Shell/ShellProtocol.c index e6d20ab16479..da8c31cb038a 100644 --- a/ShellPkg/Application/Shell/ShellProtocol.c +++ b/ShellPkg/Application/Shell/ShellProtocol.c @@ -735,50 +735,52 @@ EfiShellGetDeviceName ( // // Now check the parent controller using this as the child. // - if (DeviceNameToReturn =3D=3D NULL) { - PARSE_HANDLE_DATABASE_PARENTS (DeviceHandle, &ParentControllerCount,= &ParentControllerBuffer); + Status =3D PARSE_HANDLE_DATABASE_PARENTS (DeviceHandle, &ParentControl= lerCount, &ParentControllerBuffer); + if ((DeviceNameToReturn =3D=3D NULL) && !EFI_ERROR (Status)) { for (LoopVar =3D 0; LoopVar < ParentControllerCount; LoopVar++) { - PARSE_HANDLE_DATABASE_UEFI_DRIVERS (ParentControllerBuffer[LoopVar= ], &ParentDriverCount, &ParentDriverBuffer); - for (HandleCount =3D 0; HandleCount < ParentDriverCount; HandleCou= nt++) { - // - // try using that driver's component name with controller and ou= r driver as the child. - // - Status =3D gBS->OpenProtocol ( - ParentDriverBuffer[HandleCount], - &gEfiComponentName2ProtocolGuid, - (VOID **)&CompName2, - gImageHandle, - NULL, - EFI_OPEN_PROTOCOL_GET_PROTOCOL - ); - if (EFI_ERROR (Status)) { + Status =3D PARSE_HANDLE_DATABASE_UEFI_DRIVERS (ParentControllerBuf= fer[LoopVar], &ParentDriverCount, &ParentDriverBuffer); + if (!EFI_ERROR (Status)) { + for (HandleCount =3D 0; HandleCount < ParentDriverCount; HandleC= ount++) { + // + // try using that driver's component name with controller and = our driver as the child. + // Status =3D gBS->OpenProtocol ( ParentDriverBuffer[HandleCount], - &gEfiComponentNameProtocolGuid, + &gEfiComponentName2ProtocolGuid, (VOID **)&CompName2, gImageHandle, NULL, EFI_OPEN_PROTOCOL_GET_PROTOCOL ); - } + if (EFI_ERROR (Status)) { + Status =3D gBS->OpenProtocol ( + ParentDriverBuffer[HandleCount], + &gEfiComponentNameProtocolGuid, + (VOID **)&CompName2, + gImageHandle, + NULL, + EFI_OPEN_PROTOCOL_GET_PROTOCOL + ); + } + + if (EFI_ERROR (Status)) { + continue; + } =20 - if (EFI_ERROR (Status)) { - continue; + Lang =3D GetBestLanguageForDriver (CompName2->SupportedLangu= ages, Language, FALSE); + Status =3D CompName2->GetControllerName (CompName2, ParentCont= rollerBuffer[LoopVar], DeviceHandle, Lang, &DeviceNameToReturn); + FreePool (Lang); + Lang =3D NULL; + if (!EFI_ERROR (Status) && (DeviceNameToReturn !=3D NULL)) { + break; + } } =20 - Lang =3D GetBestLanguageForDriver (CompName2->SupportedLanguag= es, Language, FALSE); - Status =3D CompName2->GetControllerName (CompName2, ParentContro= llerBuffer[LoopVar], DeviceHandle, Lang, &DeviceNameToReturn); - FreePool (Lang); - Lang =3D NULL; + SHELL_FREE_NON_NULL (ParentDriverBuffer); if (!EFI_ERROR (Status) && (DeviceNameToReturn !=3D NULL)) { break; } } - - SHELL_FREE_NON_NULL (ParentDriverBuffer); - if (!EFI_ERROR (Status) && (DeviceNameToReturn !=3D NULL)) { - break; - } } =20 SHELL_FREE_NON_NULL (ParentControllerBuffer); diff --git a/ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.c b/S= hellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.c index 36cf46fb2c38..4549cbde9b9a 100644 --- a/ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.c +++ b/ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.c @@ -1399,10 +1399,11 @@ ShellCommandCreateInitialMappingsAndPaths ( CHAR16 *MapName; SHELL_MAP_LIST *MapListItem; =20 - SplitCurDir =3D NULL; - MapName =3D NULL; - MapListItem =3D NULL; - HandleList =3D NULL; + ConsistMappingTable =3D NULL; + SplitCurDir =3D NULL; + MapName =3D NULL; + MapListItem =3D NULL; + HandleList =3D NULL; =20 // // Reset the static members back to zero @@ -1458,32 +1459,35 @@ ShellCommandCreateInitialMappingsAndPaths ( // PerformQuickSort (DevicePathList, Count, sizeof (EFI_DEVICE_PATH_PROTO= COL *), DevicePathCompare); =20 - ShellCommandConsistMappingInitialize (&ConsistMappingTable); - // - // Assign new Mappings to all... - // - for (Count =3D 0; HandleList[Count] !=3D NULL; Count++) { + if (!EFI_ERROR (ShellCommandConsistMappingInitialize (&ConsistMappingT= able))) { // - // Get default name first + // Assign new Mappings to all... // - NewDefaultName =3D ShellCommandCreateNewMappingName (MappingTypeFile= System); - ASSERT (NewDefaultName !=3D NULL); - Status =3D ShellCommandAddMapItemAndUpdatePath (NewDefaultName, Devi= cePathList[Count], 0, TRUE); - ASSERT_EFI_ERROR (Status); - FreePool (NewDefaultName); - - // - // Now do consistent name - // - NewConsistName =3D ShellCommandConsistMappingGenMappingName (DeviceP= athList[Count], ConsistMappingTable); - if (NewConsistName !=3D NULL) { - Status =3D ShellCommandAddMapItemAndUpdatePath (NewConsistName, De= vicePathList[Count], 0, FALSE); + for (Count =3D 0; HandleList[Count] !=3D NULL; Count++) { + // + // Get default name first + // + NewDefaultName =3D ShellCommandCreateNewMappingName (MappingTypeFi= leSystem); + ASSERT (NewDefaultName !=3D NULL); + Status =3D ShellCommandAddMapItemAndUpdatePath (NewDefaultName, De= vicePathList[Count], 0, TRUE); ASSERT_EFI_ERROR (Status); - FreePool (NewConsistName); + FreePool (NewDefaultName); + + // + // Now do consistent name + // + NewConsistName =3D ShellCommandConsistMappingGenMappingName (Devic= ePathList[Count], ConsistMappingTable); + if (NewConsistName !=3D NULL) { + Status =3D ShellCommandAddMapItemAndUpdatePath (NewConsistName, = DevicePathList[Count], 0, FALSE); + ASSERT_EFI_ERROR (Status); + FreePool (NewConsistName); + } } } =20 - ShellCommandConsistMappingUnInitialize (ConsistMappingTable); + if (ConsistMappingTable !=3D NULL) { + ShellCommandConsistMappingUnInitialize (ConsistMappingTable); + } =20 SHELL_FREE_NON_NULL (HandleList); SHELL_FREE_NON_NULL (DevicePathList); @@ -1626,12 +1630,12 @@ ShellCommandUpdateMapping ( // PerformQuickSort (DevicePathList, Count, sizeof (EFI_DEVICE_PATH_PROTO= COL *), DevicePathCompare); =20 - ShellCommandConsistMappingInitialize (&ConsistMappingTable); + Status =3D ShellCommandConsistMappingInitialize (&ConsistMappingTable); =20 // // Assign new Mappings to remainders // - for (Count =3D 0; !EFI_ERROR (Status) && HandleList[Count] !=3D NULL &= & !EFI_ERROR (Status); Count++) { + for (Count =3D 0; !EFI_ERROR (Status) && HandleList[Count] !=3D NULL; = Count++) { // // Skip ones that already have // diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/Dblk.c b/ShellPkg/= Library/UefiShellDebug1CommandsLib/Dblk.c index 97a4b57a932f..5329b559ba46 100644 --- a/ShellPkg/Library/UefiShellDebug1CommandsLib/Dblk.c +++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/Dblk.c @@ -158,7 +158,10 @@ ShellCommandRunDblk ( ShellStatus =3D SHELL_INVALID_PARAMETER; } =20 - ShellConvertStringToUint64 (LbaString, &Lba, TRUE, FALSE); + if (EFI_ERROR (ShellConvertStringToUint64 (LbaString, &Lba, TRUE, = FALSE))) { + ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_GEN_PARAM_INV),= gShellDebug1HiiHandle, L"dblk", LbaString); + ShellStatus =3D SHELL_INVALID_PARAMETER; + } } =20 if (BlockCountString =3D=3D NULL) { @@ -169,12 +172,13 @@ ShellCommandRunDblk ( ShellStatus =3D SHELL_INVALID_PARAMETER; } =20 - ShellConvertStringToUint64 (BlockCountString, &BlockCount, TRUE, F= ALSE); - if (BlockCount > 0x10) { - BlockCount =3D 0x10; - } else if (BlockCount =3D=3D 0) { - ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_GEN_PARAM_INV),= gShellDebug1HiiHandle, L"dblk", BlockCountString); - ShellStatus =3D SHELL_INVALID_PARAMETER; + if (!EFI_ERROR (ShellConvertStringToUint64 (BlockCountString, &Blo= ckCount, TRUE, FALSE))) { + if (BlockCount > 0x10) { + BlockCount =3D 0x10; + } else if (BlockCount =3D=3D 0) { + ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_GEN_PARAM_INV= ), gShellDebug1HiiHandle, L"dblk", BlockCountString); + ShellStatus =3D SHELL_INVALID_PARAMETER; + } } } =20 diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/EfiDecompress.c b/= ShellPkg/Library/UefiShellDebug1CommandsLib/EfiDecompress.c index 8bf23a2076a1..72f8c087cb69 100644 --- a/ShellPkg/Library/UefiShellDebug1CommandsLib/EfiDecompress.c +++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/EfiDecompress.c @@ -112,10 +112,13 @@ ShellCommandRunEfiDecompress ( =20 if (ShellStatus =3D=3D SHELL_SUCCESS) { Status =3D FileHandleGetSize (InFileHandle, &Temp64Bit); - ASSERT (Temp64Bit <=3D (UINT32)(-1)); - InSize =3D (UINTN)Temp64Bit; ASSERT_EFI_ERROR (Status); - InBuffer =3D AllocateZeroPool (InSize); + if (!EFI_ERROR (Status)) { + ASSERT (Temp64Bit <=3D (UINT32)(-1)); + InSize =3D (UINTN)Temp64Bit; + InBuffer =3D AllocateZeroPool (InSize); + } + if (InBuffer =3D=3D NULL) { Status =3D EFI_OUT_OF_RESOURCES; } else { diff --git a/ShellPkg/Library/UefiShellDriver1CommandsLib/Connect.c b/Shell= Pkg/Library/UefiShellDriver1CommandsLib/Connect.c index d7a133c0c5b4..870c5b0d1da7 100644 --- a/ShellPkg/Library/UefiShellDriver1CommandsLib/Connect.c +++ b/ShellPkg/Library/UefiShellDriver1CommandsLib/Connect.c @@ -508,9 +508,10 @@ ShellCommandRunConnect ( Count =3D ShellCommandLineGetCount (Package); =20 if (Param1 !=3D NULL) { - Status =3D ShellConvertStringToUint64 (Param1, &Intermediate, TRU= E, FALSE); - Handle1 =3D ConvertHandleIndexToHandle ((UINTN)Intermediate); - if (EFI_ERROR (Status)) { + Status =3D ShellConvertStringToUint64 (Param1, &Intermediate, TRUE= , FALSE); + if (!EFI_ERROR (Status)) { + Handle1 =3D ConvertHandleIndexToHandle ((UINTN)Intermediate); + } else { ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_GEN_INV_HANDLE)= , gShellDriver1HiiHandle, L"connect", Param1); ShellStatus =3D SHELL_INVALID_PARAMETER; } @@ -519,9 +520,10 @@ ShellCommandRunConnect ( } =20 if (Param2 !=3D NULL) { - Status =3D ShellConvertStringToUint64 (Param2, &Intermediate, TRU= E, FALSE); - Handle2 =3D ConvertHandleIndexToHandle ((UINTN)Intermediate); - if (EFI_ERROR (Status)) { + Status =3D ShellConvertStringToUint64 (Param2, &Intermediate, TRUE= , FALSE); + if (!EFI_ERROR (Status)) { + Handle2 =3D ConvertHandleIndexToHandle ((UINTN)Intermediate); + } else { ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_GEN_INV_HANDLE)= , gShellDriver1HiiHandle, L"connect", Param2); ShellStatus =3D SHELL_INVALID_PARAMETER; } diff --git a/ShellPkg/Library/UefiShellDriver1CommandsLib/Disconnect.c b/Sh= ellPkg/Library/UefiShellDriver1CommandsLib/Disconnect.c index 009ae5282b27..fd49d1f7ceb4 100644 --- a/ShellPkg/Library/UefiShellDriver1CommandsLib/Disconnect.c +++ b/ShellPkg/Library/UefiShellDriver1CommandsLib/Disconnect.c @@ -160,12 +160,17 @@ ShellCommandRunDisconnect ( Param1 =3D ShellCommandLineGetRawValue (Package, 1); Param2 =3D ShellCommandLineGetRawValue (Package, 2); Param3 =3D ShellCommandLineGetRawValue (Package, 3); - ShellConvertStringToUint64 (Param1, &Intermediate1, TRUE, FALSE); - Handle1 =3D Param1 !=3D NULL ? ConvertHandleIndexToHandle ((UINTN)= Intermediate1) : NULL; - ShellConvertStringToUint64 (Param2, &Intermediate2, TRUE, FALSE); - Handle2 =3D Param2 !=3D NULL ? ConvertHandleIndexToHandle ((UINTN)= Intermediate2) : NULL; - ShellConvertStringToUint64 (Param3, &Intermediate3, TRUE, FALSE); - Handle3 =3D Param3 !=3D NULL ? ConvertHandleIndexToHandle ((UINTN)= Intermediate3) : NULL; + if (!EFI_ERROR (ShellConvertStringToUint64 (Param1, &Intermediate1= , TRUE, FALSE))) { + Handle1 =3D Param1 !=3D NULL ? ConvertHandleIndexToHandle ((UINT= N)Intermediate1) : NULL; + } + + if (!EFI_ERROR (ShellConvertStringToUint64 (Param2, &Intermediate2= , TRUE, FALSE))) { + Handle2 =3D Param2 !=3D NULL ? ConvertHandleIndexToHandle ((UINT= N)Intermediate2) : NULL; + } + + if (!EFI_ERROR (ShellConvertStringToUint64 (Param3, &Intermediate3= , TRUE, FALSE))) { + Handle3 =3D Param3 !=3D NULL ? ConvertHandleIndexToHandle ((UINT= N)Intermediate3) : NULL; + } =20 if ((Param1 !=3D NULL) && (Handle1 =3D=3D NULL)) { ShellPrintHiiEx (-1, -1, NULL, STRING_TOKEN (STR_GEN_INV_HANDLE)= , gShellDriver1HiiHandle, L"disconnect", Param1); diff --git a/ShellPkg/Library/UefiShellDriver1CommandsLib/DrvDiag.c b/Shell= Pkg/Library/UefiShellDriver1CommandsLib/DrvDiag.c index c645c9fd6882..8f70d6b6af39 100644 --- a/ShellPkg/Library/UefiShellDriver1CommandsLib/DrvDiag.c +++ b/ShellPkg/Library/UefiShellDriver1CommandsLib/DrvDiag.c @@ -438,25 +438,22 @@ ShellCommandRunDrvDiag ( ControllerHandleStr =3D ShellCommandLineGetRawValue (Package, 2); ChildHandleStr =3D ShellCommandLineGetRawValue (Package, 3); =20 - if (DriverHandleStr =3D=3D NULL) { - Handle1 =3D NULL; - } else { - ShellConvertStringToUint64 (DriverHandleStr, &Intermediate, TRUE, FA= LSE); + if ((DriverHandleStr !=3D NULL) && ShellConvertStringToUint64 (DriverH= andleStr, &Intermediate, TRUE, FALSE)) { Handle1 =3D ConvertHandleIndexToHandle ((UINTN)Intermediate); + } else { + Handle1 =3D NULL; } =20 - if (ControllerHandleStr =3D=3D NULL) { - Handle2 =3D NULL; - } else { - ShellConvertStringToUint64 (ControllerHandleStr, &Intermediate, TRUE= , FALSE); + if ((ControllerHandleStr !=3D NULL) && ShellConvertStringToUint64 (Con= trollerHandleStr, &Intermediate, TRUE, FALSE)) { Handle2 =3D ConvertHandleIndexToHandle ((UINTN)Intermediate); + } else { + Handle2 =3D NULL; } =20 - if (ChildHandleStr =3D=3D NULL) { - Handle3 =3D NULL; - } else { - ShellConvertStringToUint64 (ChildHandleStr, &Intermediate, TRUE, FAL= SE); + if ((ChildHandleStr !=3D NULL) && ShellConvertStringToUint64 (ChildHan= dleStr, &Intermediate, TRUE, FALSE)) { Handle3 =3D ConvertHandleIndexToHandle ((UINTN)Intermediate); + } else { + Handle3 =3D NULL; } =20 Status =3D DoDiagnostics ( --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100110): https://edk2.groups.io/g/devel/message/100110 Mute This Topic: https://groups.io/mt/96938311/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100111+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100111+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303416; cv=none; d=zohomail.com; s=zohoarc; b=ksH/323Okva3BUtyopweO/Z6C1iuFR5vJR6VZZz/1wcJlY7Oe/9f1WhrIAS4HRlcFhwlxeOporcu/VwPkIUFOq0Bkst9nbS484nQ+AomB2g69CRT3ynBhyBdfVaqp+1qcGMJrheG2F5H3u97BbtS7kfoXvVD5FVO74f6Whyrv74= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303416; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=TTxJ3bZU9lSPXBVl9gbPOi2wa/Y4zQMnl0/kzyQoi90=; b=PH5CM3pbREKuU2y2NhNZVUqEQGXZU0bRSAXypLLSsg92msFPehBfSnSFaD/LigyiRpLfQ6NyBMcdgj7uzNYpR3O6CvUN0YlCurEe72YoRcs8X+w9+8tMXwblLapdBOJfhnrdbNyXKB6EvJYeMxUfpw72mTpjymlerusbw3Mxsgw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100111+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303416855516.999801446167; Mon, 13 Feb 2023 07:50:16 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id BrrhYY1788612xE9Yci0e2AN; Mon, 13 Feb 2023 07:50:16 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web11.17982.1676303414658950063 for ; Mon, 13 Feb 2023 07:50:14 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 8244E20C8B7C; Mon, 13 Feb 2023 07:50:13 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 8244E20C8B7C From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Eric Dong , Erich McMillan , Michael D Kinney , Michael Kubacki , Rahul Kumar , Ray Ni Subject: [edk2-devel] [PATCH v3 10/12] UefiCpuPkg: Fix conditionally uninitialized variables Date: Mon, 13 Feb 2023 10:49:06 -0500 Message-Id: <20230213154908.1993-11-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: XcsAs7NksviQf8KibORSjcD1x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303416; bh=OuOvSNomE5UfD0hhhyWzHUbWieajYTaqD4+9QAf06ak=; h=Cc:Date:From:Reply-To:Subject:To; b=JOJjRPwmQTaRS/gi2XY8SSD9e3nVlIteBRLgPVL5b7ER8M7UdKWDrcwMfFrKF6ORxuD LFuDKItyBaemAaY+GAECwJnfn7ywckEcqYjGvOQxput++7S/ViHPIba8oPldZakEkP6rf YIoyq347uaNNWoGV3lE4fbIKZ7pdzmdPMUs= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303418952100007 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki Fixes CodeQL alerts for CWE-457: https://cwe.mitre.org/data/definitions/457.html Cc: Eric Dong Cc: Erich McMillan Cc: Michael D Kinney Cc: Michael Kubacki Cc: Rahul Kumar Cc: Ray Ni Co-authored-by: Erich McMillan Signed-off-by: Michael Kubacki --- UefiCpuPkg/CpuMpPei/CpuBist.c | 8 +++++++- UefiCpuPkg/CpuMpPei/CpuMpPei.c | 8 +++++++- UefiCpuPkg/CpuMpPei/CpuPaging.c | 9 ++++++++- 3 files changed, 22 insertions(+), 3 deletions(-) diff --git a/UefiCpuPkg/CpuMpPei/CpuBist.c b/UefiCpuPkg/CpuMpPei/CpuBist.c index 7dc93cd784d4..122808139b87 100644 --- a/UefiCpuPkg/CpuMpPei/CpuBist.c +++ b/UefiCpuPkg/CpuMpPei/CpuBist.c @@ -175,7 +175,13 @@ CollectBistDataFromPpi ( EFI_SEC_PLATFORM_INFORMATION_RECORD2 *PlatformInformationRecord2; EFI_SEC_PLATFORM_INFORMATION_CPU *CpuInstanceInHob; =20 - MpInitLibGetNumberOfProcessors (&NumberOfProcessors, &NumberOfEnabledPro= cessors); + Status =3D MpInitLibGetNumberOfProcessors (&NumberOfProcessors, &NumberO= fEnabledProcessors); + ASSERT_EFI_ERROR (Status); + + if (EFI_ERROR (Status)) { + NumberOfProcessors =3D 1u; + NumberOfEnabledProcessors =3D 1u; + } =20 BistInformationSize =3D sizeof (EFI_SEC_PLATFORM_INFORMATION_RECORD2) + sizeof (EFI_SEC_PLATFORM_INFORMATION_CPU) * Number= OfProcessors; diff --git a/UefiCpuPkg/CpuMpPei/CpuMpPei.c b/UefiCpuPkg/CpuMpPei/CpuMpPei.c index e7f1fe9f426c..a84304273168 100644 --- a/UefiCpuPkg/CpuMpPei/CpuMpPei.c +++ b/UefiCpuPkg/CpuMpPei/CpuMpPei.c @@ -473,7 +473,13 @@ InitializeMpExceptionStackSwitchHandlers ( return; } =20 - MpInitLibGetNumberOfProcessors (&NumberOfProcessors, NULL); + Status =3D MpInitLibGetNumberOfProcessors (&NumberOfProcessors, NULL); + ASSERT_EFI_ERROR (Status); + + if (EFI_ERROR (Status)) { + NumberOfProcessors =3D 1u; + } + SwitchStackData =3D AllocatePages (EFI_SIZE_TO_PAGES (NumberOfProcessors= * sizeof (EXCEPTION_STACK_SWITCH_CONTEXT))); ASSERT (SwitchStackData !=3D NULL); ZeroMem (SwitchStackData, NumberOfProcessors * sizeof (EXCEPTION_STACK_S= WITCH_CONTEXT)); diff --git a/UefiCpuPkg/CpuMpPei/CpuPaging.c b/UefiCpuPkg/CpuMpPei/CpuPagin= g.c index 135422225340..1322fcb77f28 100644 --- a/UefiCpuPkg/CpuMpPei/CpuPaging.c +++ b/UefiCpuPkg/CpuMpPei/CpuPaging.c @@ -538,6 +538,7 @@ SetupStackGuardPage ( UINTN NumberOfProcessors; UINTN Bsp; UINTN Index; + EFI_STATUS Status; =20 // // One extra page at the bottom of the stack is needed for Guard page. @@ -547,7 +548,13 @@ SetupStackGuardPage ( ASSERT (FALSE); } =20 - MpInitLibGetNumberOfProcessors (&NumberOfProcessors, NULL); + Status =3D MpInitLibGetNumberOfProcessors (&NumberOfProcessors, NULL); + ASSERT_EFI_ERROR (Status); + + if (EFI_ERROR (Status)) { + NumberOfProcessors =3D 1u; + } + MpInitLibWhoAmI (&Bsp); for (Index =3D 0; Index < NumberOfProcessors; ++Index) { StackBase =3D 0; --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100111): https://edk2.groups.io/g/devel/message/100111 Mute This Topic: https://groups.io/mt/96938314/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100112+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100112+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303418; cv=none; d=zohomail.com; s=zohoarc; b=clPUjgdBzpSS9W1uSKlkGsHAMaAMxNzQwfjuCFhlnMvKDxoX7UkKi7qFgznEKZPeh6YQqNxXKMKtz5DPBfLPGcQzRyHOJiJdLsZeKI3RgAqoOJo5/6SzUBP38fyjcooamSmEw7WhAoPPhVGCobNtTeLSXaUtdLtAuE7l6P1QYII= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303418; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=wlv/fJZvdAjwVvM9rlBZAQlBInXd+0DxOSkIYhvky0I=; b=bA/8r4JzbljZqmEsSiqdGZZBBhkdPQGj5DGZDiM1hgPWTMn6vKAwvD6Fb0sOHUaontiRIHIi0l9q77Y8Hsbwk6j/yrVzVeqLSj+gA4/uJvBM3sz6vOhOAcS/0GcTVTlM9Zg/02riqtljZUXYbD5OiKpwNgPC4jeXF82k1IT58fo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100112+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303418205860.2502304416794; Mon, 13 Feb 2023 07:50:18 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id 7whfYY1788612xz1kALEqBSe; Mon, 13 Feb 2023 07:50:17 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web11.17988.1676303417279004099 for ; Mon, 13 Feb 2023 07:50:17 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 6927020C8B77; Mon, 13 Feb 2023 07:50:16 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 6927020C8B77 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Sean Brogan , Michael Kubacki , Michael D Kinney Subject: [edk2-devel] [PATCH v3 11/12] .github/codeql/edk2.qls: Enable CWE 457, 676, and 758 queries Date: Mon, 13 Feb 2023 10:49:07 -0500 Message-Id: <20230213154908.1993-12-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: w1TyWTx2PNttpd7mo5LhP1aKx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303417; bh=DFwSjwBq2HyyCDNaW4i/mbRs6oZEXbczjgQrmyBAZeQ=; h=Cc:Date:From:Reply-To:Subject:To; b=cu3lU0gLSO1tpAnmIJPl82aEaPxekD2zMl4ccA0LBobmOvirP5Yrxi/KaRY+MEsscoA eY0Kq2U9/bDOhq5PnaUtCXixV9TfpPEYjedXuCDp3YjjuULc9wNpef7AWzjawyW2h6Tvm eS1RRERY6IaUPvjkV/3olKoZBN7E6DmeEc8= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303418966100008 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki The previous commits fixed issues with these queries across various packages. Now that those are resolved, enable the queries in the edk2 query set so regressions can be found in the future. Enables: 1. cpp/conditionallyuninitializedvariable - CWE: https://cwe.mitre.org/data/definitions/457.html - @name Conditionally uninitialized variable - @description An initialization function is used to initialize a local variable, but the returned status code is not checked. The variable may be left in an uninitialized state, and reading the variable may result in undefined behavior. - @kind problem - @problem.severity warning - @security-severity 7.8 - @id cpp/conditionally-uninitialized-variable - @tags security - external/cwe/cwe-457 2. cpp/pointer-overflow-check - CWE: https://cwe.mitre.org/data/definitions/758.html - @name Pointer overflow check - @description Adding a value to a pointer to check if it overflows relies on undefined behavior and may lead to memory corruption. - @kind problem - @problem.severity error - @security-severity 2.1 - @precision high - @id cpp/pointer-overflow-check - @tags reliability - security - external/cwe/cwe-758 3. cpp/potential-buffer-overflow - CWE: https://cwe.mitre.org/data/definitions/676.html - @name Potential buffer overflow - @description Using a library function that does not check buffer bounds requires the surrounding program to be very carefully written to avoid buffer overflows. - @kind problem - @id cpp/potential-buffer-overflow - @problem.severity warning - @security-severity 10.0 - @tags reliability - security - external/cwe/cwe-676 - @deprecated This query is deprecated, use Potentially overrunning write (`cpp/overrunning-write`) and Potentially overrunning write with float to string conversion (`cpp/overrunning-write-with-float`) instead. Note that cpp/potential-buffer-overflow is deprecated. This query will be updated to the succeeding queries in the next commit. The query is used in this commit to show that we considered and tested the query in history. Cc: Sean Brogan Cc: Michael Kubacki Cc: Michael D Kinney Signed-off-by: Michael Kubacki Reviewed-by: Michael D Kinney --- .github/codeql/edk2.qls | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/codeql/edk2.qls b/.github/codeql/edk2.qls index ef9aae790f5f..dc2d87764e93 100644 --- a/.github/codeql/edk2.qls +++ b/.github/codeql/edk2.qls @@ -8,7 +8,14 @@ =20 # Enable individual queries below. =20 +- include: + id: cpp/conditionallyuninitializedvariable - include: id: cpp/infinite-loop-with-unsatisfiable-exit-condition - include: id: cpp/overflow-buffer +- include: + id: cpp/pointer-overflow-check +- include: + id: cpp/potential-buffer-overflow + --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100112): https://edk2.groups.io/g/devel/message/100112 Mute This Topic: https://groups.io/mt/96938323/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:26:24 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+100113+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100113+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.microsoft.com ARC-Seal: i=1; a=rsa-sha256; t=1676303420; cv=none; d=zohomail.com; s=zohoarc; b=TsYrbApByYWN/CPw8K8TnBy3vrXRZdhk8A6CAKG3OgPdMLEFQiHsUsAI31wRluplsBOqtSPcbrrW96DEdfAdi0HmOp9LHZCwlYXJF8lbA3FDbpu/qu/LoYythUkNuS35iDRDo4pKDGky+qAx40LjDi9kaC4ArA6cS/hfPIJsdT0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1676303420; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=1u7k50KugXwpRiAszBwBVli9GC2c5aBSCaMWi8FF3tM=; b=ZHodLtjnOFEI06iRyvga1xhURgoxobAjb4GvDEnEZFeeyAYCPzJP4xjDMWfKtpVatWQ/Q7SQVL8K5ct4a+w2ELIN+95EkDIb+Nw2yPhf0eqAS+AXrIjYSp8pEHM58apDH31wkP/0eAFpmBtycskYPcWFWI29vdn9PJHNR6qpFwA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+100113+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1676303420911174.96083704053092; Mon, 13 Feb 2023 07:50:20 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id IXgBYY1788612xYtTOHV9ZqS; Mon, 13 Feb 2023 07:50:20 -0800 X-Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mx.groups.io with SMTP id smtpd.web10.17822.1676303419923422675 for ; Mon, 13 Feb 2023 07:50:20 -0800 X-Received: from localhost.localdomain (unknown [47.201.8.94]) by linux.microsoft.com (Postfix) with ESMTPSA id 21B2C20C8B73; Mon, 13 Feb 2023 07:50:19 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 21B2C20C8B73 From: "Michael Kubacki" To: devel@edk2.groups.io Cc: Sean Brogan , Michael Kubacki , Michael D Kinney Subject: [edk2-devel] [PATCH v3 12/12] .github/codeql/edk2.qls: Enable CWE 120, 787, and 805 queries Date: Mon, 13 Feb 2023 10:49:08 -0500 Message-Id: <20230213154908.1993-13-mikuback@linux.microsoft.com> In-Reply-To: <20230213154908.1993-1-mikuback@linux.microsoft.com> References: <20230213154908.1993-1-mikuback@linux.microsoft.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,mikuback@linux.microsoft.com X-Gm-Message-State: cx5zhNCApwGRVlnLkm7J7Bqgx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1676303420; bh=Zh2Xoh6a0/nFZQabHsiR953rXaFCuBG5PzTHa8MaDCA=; h=Cc:Date:From:Reply-To:Subject:To; b=aQn4VpUtlQ/4GOYmKVKScKOX8orYpv8/rtNX5/dYcytIUIT49vg5E1cN9RRM6Lh9boO KAw1fXQ4KcyBmgW4XssmpK0P/E/KjO63P2mbZyf5CVkWHWqaxlQSpz+FNC6a7axYDKUbO B71SHwPEr9ZPoREQzxMIGft4+fq0aTgyo04= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1676303422956100002 Content-Type: text/plain; charset="utf-8" From: Michael Kubacki As recommended by CodeQL this change replaces cpp/potential-buffer-overflow with cpp/overrunning-write-with-float and cpp/overrunning-write. Enables: 1. cpp/overrunning-write - @name Likely overrunning write - @description Buffer write operations that do not control the length data written may overflow - @kind problem - @problem.severity error - @security-severity 9.3 - @precision high - @id cpp/very-likely-overrunning-write - @tags reliability - security - external/cwe/cwe-120 - external/cwe/cwe-787 - external/cwe/cwe-805 2. cpp/overrunning-write-with-float - @name Potentially overrunning write with float to string conversion - @description Buffer write operations that do not control the length of data written may overflow when floating point inputs take extreme values. - @kind problem - @problem.severity error - @security-severity 9.3 - @precision medium - @id cpp/overrunning-write-with-float - @tags reliability - security - external/cwe/cwe-120 - external/cwe/cwe-787 - external/cwe/cwe-805 3. cpp/very-likely-overrunning-write - @name Likely overrunning write - @description Buffer write operations that do not control the length of data written may overflow - @kind problem - @problem.severity error - @security-severity 9.3 - @precision high - @id cpp/very-likely-overrunning-write - @tags reliability - security - external/cwe/cwe-120 - external/cwe/cwe-787 - external/cwe/cwe-805 - CWEs: - https://cwe.mitre.org/data/definitions/120.html - https://cwe.mitre.org/data/definitions/787.html - https://cwe.mitre.org/data/definitions/805.html Cc: Sean Brogan Cc: Michael Kubacki Cc: Michael D Kinney Signed-off-by: Michael Kubacki Reviewed-by: Michael D Kinney --- .github/codeql/edk2.qls | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/codeql/edk2.qls b/.github/codeql/edk2.qls index dc2d87764e93..9bea9ba01f24 100644 --- a/.github/codeql/edk2.qls +++ b/.github/codeql/edk2.qls @@ -14,8 +14,11 @@ id: cpp/infinite-loop-with-unsatisfiable-exit-condition - include: id: cpp/overflow-buffer +- include: + id: cpp/overrunning-write +- include: + id: cpp/overrunning-write-with-float - include: id: cpp/pointer-overflow-check - include: - id: cpp/potential-buffer-overflow - + id: cpp/very-likely-overrunning-write --=20 2.28.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#100113): https://edk2.groups.io/g/devel/message/100113 Mute This Topic: https://groups.io/mt/96938324/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-