mirror of
https://github.com/tianocore/edk2
synced 2026-08-27 00:23:19 -04:00
24788b6190
IScsiBuildKeyValueList parses the data segment of a received iSCSI login, text or CHAP response into key=value pairs. After locating '=' within the remaining length, it sets KeyValuePair->Value and calls AsciiStrLen(Value) to measure the value before subtracting it from the remaining length. AsciiStrLen has no length cap, and the data segment copied from the received PDU (AllocatePool(Len) + NetbufQueCopy of the data-segment length) is not guaranteed to be NUL-terminated. A malicious or redirecting target can send a data segment whose final value lacks a trailing NUL (e.g. the 3 bytes "X=Y"), so AsciiStrLen reads past the end of the segment allocation, an attacker-controlled out-of-bounds read. The SafeUint32Sub bound check only runs after the over-read. Replace AsciiStrLen(Value) with AsciiStrnLenS(Value, Len), capping the scan to the bytes remaining from Value onward. An unterminated value then returns Len and the existing SafeUint32Sub rejects the segment. The single change covers all three callers (login redirect, operational parameter negotiation and CHAP). Signed-off-by: Syed Mohammed Nayyar <jmestwa@gmail.com> |
||
|---|---|---|
| .. | ||
| ComponentName.c | ||
| IScsiAuthenticationInfo.c | ||
| IScsiCHAP.c | ||
| IScsiCHAP.h | ||
| IScsiConfig.c | ||
| IScsiConfig.h | ||
| IScsiConfigNVDataStruc.h | ||
| IScsiConfigStrings.uni | ||
| IScsiConfigVfr.vfr | ||
| IScsiDhcp.c | ||
| IScsiDhcp.h | ||
| IScsiDhcp6.c | ||
| IScsiDhcp6.h | ||
| IScsiDns.c | ||
| IScsiDns.h | ||
| IScsiDriver.c | ||
| IScsiDriver.h | ||
| IScsiDxe.inf | ||
| IScsiDxe.uni | ||
| IScsiDxeExtra.uni | ||
| IScsiExtScsiPassThru.c | ||
| IScsiIbft.c | ||
| IScsiIbft.h | ||
| IScsiImpl.h | ||
| IScsiInitiatorName.c | ||
| IScsiMisc.c | ||
| IScsiMisc.h | ||
| IScsiProto.c | ||
| IScsiProto.h | ||