uefi-ref/edk2
1
0
Fork 0
mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

MdeModulePkg: Fix Comparison overflow

Browse source 
https://github.com/github/codeql/blob/codeql-cli-2.7.3/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.qhelp

Switch to using SafeUint16Add for calculating offsets into
block data. The data being used in the calculation comes from
config block strings, and there is no validation of the values
before the calculation occurs.

Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
This commit is contained in:
Aaron Pop 2025-10-23 15:23:51 -07:00 • committed by mergify[bot]
parent 1d63461c91
commit 476b78bbad
2 changed files with 18 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

24
MdeModulePkg/Library/UefiHiiLib/HiiLib.c
View file

@ -8,6 +8,8 @@
#include "InternalHiiLib.h" #include "InternalHiiLib.h"
#include <Library/SafeIntLib.h>
#define GUID_CONFIG_STRING_TYPE 0x00 #define GUID_CONFIG_STRING_TYPE 0x00
#define NAME_CONFIG_STRING_TYPE 0x01 #define NAME_CONFIG_STRING_TYPE 0x01
#define PATH_CONFIG_STRING_TYPE 0x02 #define PATH_CONFIG_STRING_TYPE 0x02
@ -1948,6 +1950,8 @@ GetBlockDataInfo (
EFI_STATUS Status; EFI_STATUS Status;
IFR_BLOCK_DATA *BlockArray; IFR_BLOCK_DATA *BlockArray;
UINT8 *DataBuffer; UINT8 *DataBuffer;
UINT16 Sum1;
UINT16 Sum2;
// //
// Initialize the local variables. // Initialize the local variables.
@ -2144,14 +2148,20 @@ GetBlockDataInfo (
while ((Link != &BlockArray->Entry) && (Link->ForwardLink != &BlockArray->Entry)) { while ((Link != &BlockArray->Entry) && (Link->ForwardLink != &BlockArray->Entry)) {
BlockData = BASE_CR (Link, IFR_BLOCK_DATA, Entry); BlockData = BASE_CR (Link, IFR_BLOCK_DATA, Entry);
NewBlockData = BASE_CR (Link->ForwardLink, IFR_BLOCK_DATA, Entry); NewBlockData = BASE_CR (Link->ForwardLink, IFR_BLOCK_DATA, Entry);
if ((NewBlockData->Offset >= BlockData->Offset) && (NewBlockData->Offset <= (BlockData->Offset + BlockData->Width))) { if ((!EFI_ERROR (SafeUint16Add (BlockData->Offset, BlockData->Width, &Sum1))) &&
if ((NewBlockData->Offset + NewBlockData->Width) > (BlockData->Offset + BlockData->Width)) { (!EFI_ERROR (SafeUint16Add (NewBlockData->Offset, NewBlockData->Width, &Sum2))) &&
BlockData->Width = (UINT16)(NewBlockData->Offset + NewBlockData->Width - BlockData->Offset); (NewBlockData->Offset >= BlockData->Offset) &&
(NewBlockData->Offset <= Sum1) &&
(Sum2 > Sum1))
{
Sum1 = BlockData->Width;
if (!EFI_ERROR (SafeUint16Sub (Sum2, BlockData->Offset, &BlockData->Width))) {
RemoveEntryList (Link->ForwardLink);
FreePool (NewBlockData);
continue;
} else {
BlockData->Width = Sum1;
} }
RemoveEntryList (Link->ForwardLink);
FreePool (NewBlockData);
continue;
} }
Link = Link->ForwardLink; Link = Link->ForwardLink;

1
MdeModulePkg/Library/UefiHiiLib/UefiHiiLib.inf
View file

@ -41,6 +41,7 @@
UefiLib UefiLib
UefiHiiServicesLib UefiHiiServicesLib
PrintLib PrintLib
SafeIntLib
[Protocols] [Protocols]
gEfiFormBrowser2ProtocolGuid ## SOMETIMES_CONSUMES gEfiFormBrowser2ProtocolGuid ## SOMETIMES_CONSUMES