uefi-ref/edk2
1
0
Fork 0
mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

EmbeddedPkg/PrePiLib: Prevent overread with FFS size macros

Browse source 
Symptom:Unsafe typecasting may lead to out‑of‑bound memory access

RootCause: FileSize and FileLength are declared as
UINT32 and masked with 0x00FFFFFF to store only the lower 24 bits.
Although this approach yields the correct result,
it introduces a potential risk due to unsafe typecasting and
dereferencing.

Solution: Using the predefined macro FFS_FILE_SIZE()
from MdePkg\Include\Pi\PiFirmwareFile.h,
which safely performs the same operation by reconstructing
the size using individual byte access.

This commit also addresses the fix for coverity isssue "OVERRUN"

Cc: Sachin Ganesh <sachinganesh@ami.com>
Signed-off-by: Gowtham M <gowthamm@ami.com>
This commit is contained in:
Gowtham M 2025-11-04 12:07:59 +05:30 • committed by mergify[bot]
parent 9989454219
commit 3b0deb5e79
1 changed files with 6 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

14
EmbeddedPkg/Library/PrePiLib/FwVol.c
View file

@ -10,6 +10,7 @@
**/
#include <PrePi.h>
#include <Pi/PiFirmwareFile.h>
#include <Library/ExtractGuidedSectionLib.h>
#define GET_OCCUPIED_SIZE(ActualSize, Alignment) \
@ -190,10 +191,9 @@ FindFileEx (
}
} else {
//
// Length is 24 bits wide so mask upper 8 bits
// FileLength is adjusted to FileOccupiedSize as it is 8 byte aligned.
//
FileLength = *(UINT32 *)(*FileHeader)->Size & 0x00FFFFFF;
FileLength = FFS_FILE_SIZE (*FileHeader);
FileOccupiedSize = GET_OCCUPIED_SIZE (FileLength, 8);
FfsFileHeader = (EFI_FFS_FILE_HEADER *)((UINT8 *)*FileHeader + FileOccupiedSize);
}
@ -224,7 +224,7 @@ FindFileEx (
return EFI_NOT_FOUND;
}
FileLength = *(UINT32 *)(FfsFileHeader->Size) & 0x00FFFFFF;
FileLength = FFS_FILE_SIZE (FfsFileHeader);
FileOccupiedSize = GET_OCCUPIED_SIZE (FileLength, 8);
if (FileName != NULL) {
@ -244,7 +244,7 @@ FindFileEx (
break;
case EFI_FILE_DELETED:
FileLength = *(UINT32 *)(FfsFileHeader->Size) & 0x00FFFFFF;
FileLength = FFS_FILE_SIZE (FfsFileHeader);
FileOccupiedSize = GET_OCCUPIED_SIZE (FileLength, 8);
FileOffset += FileOccupiedSize;
FfsFileHeader = (EFI_FFS_FILE_HEADER *)((UINT8 *)FfsFileHeader + FileOccupiedSize);
@ -545,12 +545,10 @@ FfsFindSectionDataWithHook (
FfsFileHeader = (EFI_FFS_FILE_HEADER *)(FileHandle);
//
// Size is 24 bits wide so mask upper 8 bits.
// Does not include FfsFileHeader header size
// FileSize is adjusted to FileOccupiedSize as it is 8 byte aligned.
//
Section = (EFI_COMMON_SECTION_HEADER *)(FfsFileHeader + 1);
FileSize = *(UINT32 *)(FfsFileHeader->Size) & 0x00FFFFFF;
FileSize = FFS_FILE_SIZE (FfsFileHeader);
FileSize -= sizeof (EFI_FFS_FILE_HEADER);
return FfsProcessSection (
@ -752,7 +750,7 @@ FfsGetFileInfo (
CopyMem (&FileInfo->FileName, &FileHeader->Name, sizeof (EFI_GUID));
FileInfo->FileType = FileHeader->Type;
FileInfo->FileAttributes = FileHeader->Attributes;
FileInfo->BufferSize = ((*(UINT32 *)FileHeader->Size) & 0x00FFFFFF) - sizeof (EFI_FFS_FILE_HEADER);
FileInfo->BufferSize = (FFS_FILE_SIZE (FileHeader) - sizeof (EFI_FFS_FILE_HEADER));
FileInfo->Buffer = (FileHeader + 1);
return EFI_SUCCESS;
}