From 7c410b3d4180087020c7734bf67cdc4ad9fdb136 Mon Sep 17 00:00:00 2001 From: Qin Long Date: Fri, 31 Mar 2017 22:12:45 +0800 Subject: CryptoPkg/BaseCryptLib: Adding NULL checking in time() wrapper. There are some explicit time(NULL) calls in openssl-1.1.0xx source, but the dummy time() wrapper in ConstantTimeClock.c (used by PEI and SMM module) has no any checks on NULL parameter. This is one bug and will cause the memory access issue. This patch adds the NULL parameter checking in time() wrapper. Cc: Ting Ye Cc: Eric Dong Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long Reviewed-by: Laszlo Ersek --- CryptoPkg/Library/BaseCryptLib/SysCall/ConstantTimeClock.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'CryptoPkg') diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/ConstantTimeClock.c b/CryptoPkg/Library/BaseCryptLib/SysCall/ConstantTimeClock.c index 7f20164999..0cd90434ca 100644 --- a/CryptoPkg/Library/BaseCryptLib/SysCall/ConstantTimeClock.c +++ b/CryptoPkg/Library/BaseCryptLib/SysCall/ConstantTimeClock.c @@ -31,8 +31,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. time_t time (time_t *timer) { - *timer = 0; - return *timer; + if (timer != NULL) { + *timer = 0; + } + return 0; } struct tm * gmtime (const time_t *timer) -- cgit v1.2.3