1. Patchew
  2. EDK2
  3. View series

[edk2] [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential issue

Song, BinX posted 1 patch 7 years, 6 months ago
Failed in applying to current master (apply log)
.../Library/BrotliCustomDecompressLib/BrotliDecompress.c     |  1 +
MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c  | 12 ++++++++----
2 files changed, 9 insertions(+), 4 deletions(-)
[edk2] [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential issue
Posted by Song, BinX 7 years, 6 months ago 
- Fix BrotliCustomDecompressLib potential issue

Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Bell Song <binx.song@intel.com>
---
 .../Library/BrotliCustomDecompressLib/BrotliDecompress.c     |  1 +
 MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c  | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
index 2c2648a..a303921 100644
--- a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
+++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
@@ -126,6 +126,7 @@ BrotliDecompress (
   BrotliState *  BroState;
   VOID *         Temp;
 
+  TotalOut = 0;
   AvailableOut = FILE_BUFFER_SIZE;
   Result = BROTLI_RESULT_ERROR;
   BroState = BrotliCreateState(BrAlloc, BrFree, BuffInfo);
diff --git a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
index 1ebab3c..c49fab9 100644
--- a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
+++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
@@ -802,6 +802,7 @@ static BROTLI_INLINE uint32_t ReadBlockLength(const HuffmanCode* table,
   uint32_t code;
   uint32_t nbits;
   code = ReadSymbol(table, br);
+  if (code >= BROTLI_NUM_BLOCK_LEN_SYMBOLS) code = BROTLI_NUM_BLOCK_LEN_SYMBOLS - 1;
   nbits = kBlockLengthPrefixCode[code].nbits; /* nbits == 2..24 */
   return kBlockLengthPrefixCode[code].offset + BrotliReadBits(br, nbits);
 }
@@ -872,13 +873,13 @@ static BROTLI_NOINLINE void InverseMoveToFrontTransform(
   for (i = 0; i < v_len; ++i) {
     int index = v[i];
     uint8_t value = mtf[index];
-    upper_bound |= v[i];
+    upper_bound |= (uint32_t)v[i];
     v[i] = value;
     mtf[-1] = value;
-    do {
+    while (index > 0) {
       index--;
       mtf[index + 1] = mtf[index];
-    } while (index >= 0);
+    }
   }
   /* Remember amount of elements to be reinitialized. */
   state->mtf_upper_bound = upper_bound;
@@ -1498,6 +1499,7 @@ static BROTLI_INLINE BROTLI_BOOL ReadCommandInternal(
       return BROTLI_FALSE;
     }
   }
+  if (cmd_code >= BROTLI_NUM_COMMAND_SYMBOLS) cmd_code = BROTLI_NUM_COMMAND_SYMBOLS - 1;
   v = kCmdLut[cmd_code];
   s->distance_code = v.distance_code;
   s->distance_context = v.context;
@@ -2209,7 +2211,9 @@ BrotliDecoderResult BrotliDecoderDecompressStream(
         }
         s->max_distance = s->max_backward_distance;
         if (s->state == BROTLI_STATE_COMMAND_POST_WRITE_1) {
-          memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
+          if (s->ringbuffer != 0) {
+            memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
+          }
           if (s->meta_block_remaining_len == 0) {
             /* Next metablock, if any */
             s->state = BROTLI_STATE_METABLOCK_DONE;
-- 
2.10.2.windows.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential issue
Posted by Gao, Liming 7 years, 6 months ago 
Reviewed-by: Liming Gao <liming.gao@intel.com>

>-----Original Message-----
>From: Song, BinX
>Sent: Friday, April 07, 2017 2:52 PM
>To: edk2-devel@lists.01.org
>Cc: Gao, Liming <liming.gao@intel.com>
>Subject: [PATCH] MdeModulePkg: Fix BrotliCustomDecompressLib potential
>issue
>
>- Fix BrotliCustomDecompressLib potential issue
>
>Cc: Liming Gao <liming.gao@intel.com>
>Contributed-under: TianoCore Contribution Agreement 1.0
>Signed-off-by: Bell Song <binx.song@intel.com>
>---
> .../Library/BrotliCustomDecompressLib/BrotliDecompress.c     |  1 +
> MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c  | 12
>++++++++----
> 2 files changed, 9 insertions(+), 4 deletions(-)
>
>diff --git
>a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
>b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
>index 2c2648a..a303921 100644
>---
>a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
>+++
>b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c
>@@ -126,6 +126,7 @@ BrotliDecompress (
>   BrotliState *  BroState;
>   VOID *         Temp;
>
>+  TotalOut = 0;
>   AvailableOut = FILE_BUFFER_SIZE;
>   Result = BROTLI_RESULT_ERROR;
>   BroState = BrotliCreateState(BrAlloc, BrFree, BuffInfo);
>diff --git
>a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
>b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
>index 1ebab3c..c49fab9 100644
>--- a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
>+++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
>@@ -802,6 +802,7 @@ static BROTLI_INLINE uint32_t ReadBlockLength(const
>HuffmanCode* table,
>   uint32_t code;
>   uint32_t nbits;
>   code = ReadSymbol(table, br);
>+  if (code >= BROTLI_NUM_BLOCK_LEN_SYMBOLS) code =
>BROTLI_NUM_BLOCK_LEN_SYMBOLS - 1;
>   nbits = kBlockLengthPrefixCode[code].nbits; /* nbits == 2..24 */
>   return kBlockLengthPrefixCode[code].offset + BrotliReadBits(br, nbits);
> }
>@@ -872,13 +873,13 @@ static BROTLI_NOINLINE void
>InverseMoveToFrontTransform(
>   for (i = 0; i < v_len; ++i) {
>     int index = v[i];
>     uint8_t value = mtf[index];
>-    upper_bound |= v[i];
>+    upper_bound |= (uint32_t)v[i];
>     v[i] = value;
>     mtf[-1] = value;
>-    do {
>+    while (index > 0) {
>       index--;
>       mtf[index + 1] = mtf[index];
>-    } while (index >= 0);
>+    }
>   }
>   /* Remember amount of elements to be reinitialized. */
>   state->mtf_upper_bound = upper_bound;
>@@ -1498,6 +1499,7 @@ static BROTLI_INLINE BROTLI_BOOL
>ReadCommandInternal(
>       return BROTLI_FALSE;
>     }
>   }
>+  if (cmd_code >= BROTLI_NUM_COMMAND_SYMBOLS) cmd_code =
>BROTLI_NUM_COMMAND_SYMBOLS - 1;
>   v = kCmdLut[cmd_code];
>   s->distance_code = v.distance_code;
>   s->distance_context = v.context;
>@@ -2209,7 +2211,9 @@ BrotliDecoderResult
>BrotliDecoderDecompressStream(
>         }
>         s->max_distance = s->max_backward_distance;
>         if (s->state == BROTLI_STATE_COMMAND_POST_WRITE_1) {
>-          memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
>+          if (s->ringbuffer != 0) {
>+            memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
>+          }
>           if (s->meta_block_remaining_len == 0) {
>             /* Next metablock, if any */
>             s->state = BROTLI_STATE_METABLOCK_DONE;
>--
>2.10.2.windows.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Patchew 2.1-devel-b67e4c2

© 2016 - 2024 Red Hat, Inc.