[U-Boot] [PATCH 2/6] efi_loader: Fix memory map size check to avoid out-of-bounds access
memory_map_size as IN parameter specifies the size of the provided buffer. If the buffer is to small, memory_map_size is updated to indicate the required size, and an error code is returned.
Signed-off-by: Stefan Brüns stefan.bruens@rwth-aachen.de --- lib/efi_loader/efi_memory.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index ebe8e94..5d71fdf 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -342,16 +342,18 @@ efi_status_t efi_get_memory_map(unsigned long *memory_map_size,
map_size = map_entries * sizeof(struct efi_mem_desc);
- *memory_map_size = map_size; - if (descriptor_size) *descriptor_size = sizeof(struct efi_mem_desc);
if (descriptor_version) *descriptor_version = EFI_MEMORY_DESCRIPTOR_VERSION;
- if (*memory_map_size < map_size) + if (*memory_map_size < map_size) { + *memory_map_size = map_size; return EFI_BUFFER_TOO_SMALL; + } + + *memory_map_size = map_size;
/* Copy list into array */ if (memory_map) {
On 30.09.16 02:03, Stefan Brüns wrote:
memory_map_size as IN parameter specifies the size of the provided buffer. If the buffer is to small, memory_map_size is updated to indicate the required size, and an error code is returned.
Signed-off-by: Stefan Brüns stefan.bruens@rwth-aachen.de
This patch doesn't actually change anything, does it?
Alex
lib/efi_loader/efi_memory.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index ebe8e94..5d71fdf 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -342,16 +342,18 @@ efi_status_t efi_get_memory_map(unsigned long *memory_map_size,
map_size = map_entries * sizeof(struct efi_mem_desc);
*memory_map_size = map_size;
if (descriptor_size) *descriptor_size = sizeof(struct efi_mem_desc);
if (descriptor_version) *descriptor_version = EFI_MEMORY_DESCRIPTOR_VERSION;
if (*memory_map_size < map_size)
if (*memory_map_size < map_size) {
*memory_map_size = map_size;return EFI_BUFFER_TOO_SMALL;
}
*memory_map_size = map_size;
/* Copy list into array */ if (memory_map) {
On Freitag, 30. September 2016 14:25:40 CEST Alexander Graf wrote:
On 30.09.16 02:03, Stefan Brüns wrote:
memory_map_size as IN parameter specifies the size of the provided buffer. If the buffer is to small, memory_map_size is updated to indicate the required size, and an error code is returned.
Signed-off-by: Stefan Brüns stefan.bruens@rwth-aachen.de
This patch doesn't actually change anything, does it?
It does ...
Alex
lib/efi_loader/efi_memory.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index ebe8e94..5d71fdf 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -342,16 +342,18 @@ efi_status_t efi_get_memory_map(unsigned long *memory_map_size,> map_size = map_entries * sizeof(struct efi_mem_desc);
- *memory_map_size = map_size;
The caller provided buffer size was changed here
if (descriptor_size)
*descriptor_size = sizeof(struct efi_mem_desc);
if (descriptor_version)
*descriptor_version = EFI_MEMORY_DESCRIPTOR_VERSION;
if (*memory_map_size < map_size)
-> this check was always false
if (*memory_map_size < map_size) {
*memory_map_size = map_size;return EFI_BUFFER_TOO_SMALL;
}
*memory_map_size = map_size;
/* Copy list into array */ if (memory_map) {
On 30.09.16 16:15, Brüns, Stefan wrote:
On Freitag, 30. September 2016 14:25:40 CEST Alexander Graf wrote:
On 30.09.16 02:03, Stefan Brüns wrote:
memory_map_size as IN parameter specifies the size of the provided buffer. If the buffer is to small, memory_map_size is updated to indicate the required size, and an error code is returned.
Signed-off-by: Stefan Brüns stefan.bruens@rwth-aachen.de
This patch doesn't actually change anything, does it?
It does ...
Alex
lib/efi_loader/efi_memory.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index ebe8e94..5d71fdf 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -342,16 +342,18 @@ efi_status_t efi_get_memory_map(unsigned long *memory_map_size,> map_size = map_entries * sizeof(struct efi_mem_desc);
- *memory_map_size = map_size;
The caller provided buffer size was changed here
if (descriptor_size)
*descriptor_size = sizeof(struct efi_mem_desc);
if (descriptor_version)
*descriptor_version = EFI_MEMORY_DESCRIPTOR_VERSION;
if (*memory_map_size < map_size)
-> this check was always false
Ah, I see it now. Could you please adjust the commit message to point that out properly? :)
Thanks!
Alex
participants (3)
-
Alexander Graf -
Brüns, Stefan -
Stefan Brüns