diff options
Diffstat (limited to 'EdkCompatibilityPkg/Foundation/Library/Pei')
| -rw-r--r-- | EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c | 51 | ||||
| -rw-r--r-- | EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/PeCoffLoader.c | 39 |
2 files changed, 74 insertions, 16 deletions
diff --git a/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c b/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c index ff467375b0..6d09c6152e 100644 --- a/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c +++ b/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c @@ -1,6 +1,6 @@ /*++
-Copyright (c) 2004, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2010, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -312,14 +312,32 @@ Returns: UINT16 NextCode;
UINT16 Mask;
- for (Index = 1; Index <= 16; Index++) {
+ //
+ // TableBits should not be greater than 16.
+ //
+ if (TableBits >= (sizeof (Count)/sizeof (UINT16))) {
+ return (UINT16) BAD_TABLE;
+ }
+
+ //
+ // Initialize Count array starting from Index 0, as there is a possibility of Count array being uninitialized.
+ //
+ for (Index = 0; Index <= 16; Index++) {
Count[Index] = 0;
}
for (Index = 0; Index < NumOfChar; Index++) {
- Count[BitLen[Index]]++;
+ //
+ // Count array index should not be greater than or equal to its size.
+ //
+ if (BitLen[Index] < (sizeof (Count)/sizeof (UINT16))) {
+ Count[BitLen[Index]]++;
+ } else {
+ return (UINT16) BAD_TABLE;
+ }
}
+ Start[0] = 0;
Start[1] = 0;
for (Index = 1; Index <= 16; Index++) {
@@ -358,7 +376,7 @@ Returns: for (Char = 0; Char < NumOfChar; Char++) {
Len = BitLen[Char];
- if (Len == 0) {
+ if (Len == 0 || Len >= 17) {
continue;
}
@@ -377,14 +395,20 @@ Returns: Index = (UINT16) (Len - TableBits);
while (Index != 0) {
- if (*Pointer == 0) {
+ //
+ // Avail should be lesser than size of mRight and mLeft to prevent buffer overflow.
+ //
+ if ((*Pointer == 0) && (Avail < sizeof (Sd->mRight)/sizeof (UINT16)) && (Avail < sizeof (Sd->mLeft)/sizeof (UINT16))) {
Sd->mRight[Avail] = Sd->mLeft[Avail] = 0;
*Pointer = Avail++;
}
- if (Index3 & Mask) {
+ //
+ // *Pointer should be lesser than size of mRight and mLeft to prevent buffer overflow.
+ //
+ if ((Index3 & Mask) && (*Pointer < (sizeof (Sd->mRight)/sizeof (UINT16)))) {
Pointer = &Sd->mRight[*Pointer];
- } else {
+ } else if (*Pointer < (sizeof (Sd->mLeft)/sizeof (UINT16))) {
Pointer = &Sd->mLeft[*Pointer];
}
@@ -493,6 +517,13 @@ Returns: Number = (UINT16) GetBits (Sd, nbit);
+ if ((Number > sizeof (Sd->mPTLen)) || (nn > sizeof (Sd->mPTLen))) {
+ //
+ // Fail if Number or nn is greater than size of mPTLen
+ //
+ return (UINT16) BAD_TABLE;
+ }
+
if (Number == 0) {
CharC = (UINT16) GetBits (Sd, nbit);
@@ -528,6 +559,12 @@ Returns: if (Index == Special) {
CharC = (UINT16) GetBits (Sd, 2);
while ((INT16) (--CharC) >= 0) {
+ if (Index >= sizeof (Sd->mPTLen)) {
+ //
+ // Fail if Index is greater than or equal to mPTLen
+ //
+ return (UINT16) BAD_TABLE;
+ }
Sd->mPTLen[Index++] = 0;
}
}
diff --git a/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/PeCoffLoader.c b/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/PeCoffLoader.c index 68c4e96e8d..bc4ca8ee66 100644 --- a/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/PeCoffLoader.c +++ b/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/PeCoffLoader.c @@ -1,6 +1,6 @@ /*++
-Copyright (c) 2005 - 2007, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2005 - 2010, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -785,12 +785,18 @@ Returns: // the optional header to verify a desired directory entry is there.
//
- if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_BASERELOC) {
+ if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_BASERELOC && RelocDir->Size > 0) {
RelocBase = PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress);
RelocBaseEnd = PeCoffLoaderImageAddress (
ImageContext,
RelocDir->VirtualAddress + RelocDir->Size - 1
);
+ if ((RelocBase == NULL) || (RelocBaseEnd == NULL)) {
+ //
+ // If the base start or end address resolved to 0, then fail.
+ //
+ return EFI_LOAD_ERROR;
+ }
} else {
//
// Set base and end to bypass processing below.
@@ -806,13 +812,21 @@ Returns: // Find the relocation block
//
RelocDir = &Hdr.Te->DataDirectory[0];
- RelocBase = (EFI_IMAGE_BASE_RELOCATION *)(UINTN)(
- ImageContext->ImageAddress +
- RelocDir->VirtualAddress +
- sizeof(EFI_TE_IMAGE_HEADER) -
- Hdr.Te->StrippedSize
- );
- RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *) ((UINTN) RelocBase + (UINTN) RelocDir->Size - 1);
+ if (RelocDir->Size > 0) {
+ RelocBase = (EFI_IMAGE_BASE_RELOCATION *)(UINTN)(
+ ImageContext->ImageAddress +
+ RelocDir->VirtualAddress +
+ sizeof(EFI_TE_IMAGE_HEADER) -
+ Hdr.Te->StrippedSize
+ );
+ RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *) ((UINTN) RelocBase + (UINTN) RelocDir->Size - 1);
+ } else {
+ //
+ // Set base and end to bypass processing below.
+ //
+ RelocBase = NULL;
+ RelocBaseEnd = NULL;
+ }
}
//
@@ -825,6 +839,13 @@ Returns: RelocEnd = (UINT16 *) ((CHAR8 *) RelocBase + RelocBase->SizeOfBlock);
if (!(ImageContext->IsTeImage)) {
FixupBase = PeCoffLoaderImageAddress (ImageContext, RelocBase->VirtualAddress);
+
+ if (FixupBase == NULL) {
+ //
+ // If the FixupBase address resolved to 0, then fail.
+ //
+ return EFI_LOAD_ERROR;
+ }
} else {
FixupBase = (CHAR8 *)(UINTN)(ImageContext->ImageAddress +
RelocBase->VirtualAddress +
|