* [U-Boot] [PATCH v2] efi_selftest: check for buffer overflow in efi_get_variable
@ 2018-05-25 17:45 Ivan Gorinov
2018-06-03 13:29 ` [U-Boot] [U-Boot, " Alexander Graf
0 siblings, 1 reply; 2+ messages in thread
From: Ivan Gorinov @ 2018-05-25 17:45 UTC (permalink / raw)
To: u-boot
Allocate a buffer on the stack instead of an array of uninitialized
pointers; check if GetVariable writes past the end of the buffer.
Signed-off-by: Ivan Gorinov <ivan.gorinov@intel.com>
---
lib/efi_selftest/efi_selftest_variables.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/lib/efi_selftest/efi_selftest_variables.c b/lib/efi_selftest/efi_selftest_variables.c
index f5e8eb6..146378f 100644
--- a/lib/efi_selftest/efi_selftest_variables.c
+++ b/lib/efi_selftest/efi_selftest_variables.c
@@ -49,7 +49,7 @@ static int execute(void)
u32 attr;
u8 v[16] = {0x5d, 0xd1, 0x5e, 0x51, 0x5a, 0x05, 0xc7, 0x0c,
0x35, 0x4a, 0xae, 0x87, 0xa5, 0xdf, 0x0f, 0x65,};
- u8 *data[EFI_ST_MAX_DATA_SIZE];
+ u8 data[EFI_ST_MAX_DATA_SIZE];
u16 varname[EFI_ST_MAX_VARNAME_SIZE];
int flag;
efi_guid_t guid;
@@ -72,6 +72,22 @@ static int execute(void)
efi_st_error("SetVariable failed\n");
return EFI_ST_FAILURE;
}
+ data[3] = 0xff;
+ len = 3;
+ ret = runtime->get_variable(L"efi_st_var0", &guid_vendor0,
+ &attr, &len, data);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("GetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+ if (efi_st_memcmp(data, v + 4, 3)) {
+ efi_st_error("GetVariable returned wrong value\n");
+ return EFI_ST_FAILURE;
+ }
+ if (data[3] != 0xff) {
+ efi_st_error("GetVariable wrote past the end of the buffer\n");
+ return EFI_ST_FAILURE;
+ }
/* Set variable 1 */
ret = runtime->set_variable(L"efi_st_var1", &guid_vendor1,
EFI_VARIABLE_BOOTSERVICE_ACCESS,
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [U-Boot] [U-Boot, v2] efi_selftest: check for buffer overflow in efi_get_variable
2018-05-25 17:45 [U-Boot] [PATCH v2] efi_selftest: check for buffer overflow in efi_get_variable Ivan Gorinov
@ 2018-06-03 13:29 ` Alexander Graf
0 siblings, 0 replies; 2+ messages in thread
From: Alexander Graf @ 2018-06-03 13:29 UTC (permalink / raw)
To: u-boot
> Allocate a buffer on the stack instead of an array of uninitialized
> pointers; check if GetVariable writes past the end of the buffer.
>
> Signed-off-by: Ivan Gorinov <ivan.gorinov@intel.com>
Thanks, applied to efi-next
Alex
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-06-03 13:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-25 17:45 [U-Boot] [PATCH v2] efi_selftest: check for buffer overflow in efi_get_variable Ivan Gorinov
2018-06-03 13:29 ` [U-Boot] [U-Boot, " Alexander Graf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.