File ovmf-bsc1115917-bounds-checking-for-ueficompres... of Package ovmf

Overview Repositories Revisions Requests Users Attributes Meta

File ovmf-bsc1115917-bounds-checking-for-ueficompress.patch of Package ovmf (Revision f021fadb8b3a731db3bbb6d17cc4d2c2)

Currently displaying revision f021fadb8b3a731db3bbb6d17cc4d2c2 , Show latest

From 2c959247bf82755fd38a5001238e6f0ccd6cf07f Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Tue, 16 Oct 2018 10:06:11 +0800
Subject: [PATCH 1/7] MdePkg: Add more checker in UefiDecompressLib to access
 the valid buffer only (CVE FIX)

Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735
https://bugzilla.tianocore.org/show_bug.cgi?id=686

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com>
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 2ec7953d49677142c5f7552e9e3d96fb406ba0c4)
---
 .../BaseUefiDecompressLib.c                     | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
index e818543d9255..0c6b1fe4ee83 100644
--- a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
+++ b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
@@ -152,6 +152,7 @@ MakeTable (
   UINT16  Mask;
   UINT16  WordOfStart;
   UINT16  WordOfCount;
+  UINT16  MaxTableLength;
 
   //
   // The maximum mapping table width supported by this internal
@@ -164,6 +165,9 @@ MakeTable (
   }
 
   for (Index = 0; Index < NumOfChar; Index++) {
+    if (BitLen[Index] > 16) {
+      return (UINT16) BAD_TABLE;
+    }
     Count[BitLen[Index]]++;
   }
   
@@ -205,6 +209,7 @@ MakeTable (
 
   Avail = NumOfChar;
   Mask  = (UINT16) (1U << (15 - TableBits));
+  MaxTableLength = (UINT16) (1U << TableBits);
 
   for (Char = 0; Char < NumOfChar; Char++) {
 
@@ -218,6 +223,9 @@ MakeTable (
     if (Len <= TableBits) {
 
       for (Index = Start[Len]; Index < NextCode; Index++) {
+        if (Index >= MaxTableLength) {
+          return (UINT16) BAD_TABLE;
+        }
         Table[Index] = Char;
       }
 
@@ -620,11 +628,16 @@ Decode (
       // Write BytesRemain of bytes into mDstBase
       //
       BytesRemain--;
+
       while ((INT16) (BytesRemain) >= 0) {
-        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
         if (Sd->mOutBuf >= Sd->mOrigSize) {
           goto Done;
         }
+        if (DataIdx >= Sd->mOrigSize) {
+          Sd->mBadTableFlag = (UINT16) BAD_TABLE;
+          goto Done;
+        }
+        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
 
         BytesRemain--;
       }
@@ -694,7 +707,7 @@ UefiDecompressGetInfo (
   }
 
   CompressedSize   = ReadUnaligned32 ((UINT32 *)Source);
-  if (SourceSize < (CompressedSize + 8)) {
+  if (SourceSize < (CompressedSize + 8) || (CompressedSize + 8) < 8) {
     return RETURN_INVALID_PARAMETER;
   }
 
-- 
2.19.1

From 7c0b8f75fc6bcb0e10a5b55f1ba73d764752202a Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Tue, 16 Oct 2018 10:06:12 +0800
Subject: [PATCH 2/7] IntelFrameworkModulePkg: Add more checker in
 UefiTianoDecompressLib (CVE FIX)

Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735
https://bugzilla.tianocore.org/show_bug.cgi?id=686
To make sure the valid buffer be accessed only.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com>
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 684db6da64bc7b5faee4e1174e801c245f563b5c)
---
 .../BaseUefiTianoCustomDecompressLib.c           | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
index cb009e7771bb..9b001667ef7e 100644
--- a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
+++ b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c
@@ -143,6 +143,7 @@ MakeTable (
   UINT16  Mask;
   UINT16  WordOfStart;
   UINT16  WordOfCount;
+  UINT16  MaxTableLength;
 
   //
   // The maximum mapping table width supported by this internal
@@ -155,6 +156,9 @@ MakeTable (
   }
 
   for (Index = 0; Index < NumOfChar; Index++) {
+    if (BitLen[Index] > 16) {
+      return (UINT16) BAD_TABLE;
+    }
     Count[BitLen[Index]]++;
   }
   
@@ -196,6 +200,7 @@ MakeTable (
 
   Avail = NumOfChar;
   Mask  = (UINT16) (1U << (15 - TableBits));
+  MaxTableLength = (UINT16) (1U << TableBits);
 
   for (Char = 0; Char < NumOfChar; Char++) {
 
@@ -209,6 +214,9 @@ MakeTable (
     if (Len <= TableBits) {
 
       for (Index = Start[Len]; Index < NextCode; Index++) {
+        if (Index >= MaxTableLength) {
+          return (UINT16) BAD_TABLE;
+        }
         Table[Index] = Char;
       }
 
@@ -615,10 +623,14 @@ Decode (
       //
       BytesRemain--;
       while ((INT16) (BytesRemain) >= 0) {
-        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
         if (Sd->mOutBuf >= Sd->mOrigSize) {
           goto Done ;
         }
+        if (DataIdx >= Sd->mOrigSize) {
+          Sd->mBadTableFlag = (UINT16) BAD_TABLE;
+          goto Done ;
+        }
+        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
 
         BytesRemain--;
       }
@@ -688,7 +700,7 @@ UefiDecompressGetInfo (
   }
 
   CompressedSize   = ReadUnaligned32 ((UINT32 *)Source);
-  if (SourceSize < (CompressedSize + 8)) {
+  if (SourceSize < (CompressedSize + 8) || (CompressedSize + 8) < 8) {
     return RETURN_INVALID_PARAMETER;
   }
 
-- 
2.19.1

From 997784f1a89fbee08cacf5efbcb3ff380dac2c33 Mon Sep 17 00:00:00 2001
From: Yunhua Feng <yunhuax.feng@intel.com>
Date: Sun, 30 Sep 2018 11:07:18 +0800
Subject: [PATCH 3/7] BaseTools: Add --uefi option to enable UefiCompress
 method

Add one new option --uefi to enable UefiCompress.
(re-add this patch since it be reverted in Python3 migration patches,
but this patch is not related with Python3)

Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Yunhua Feng <yunhuax.feng@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit f1400101a732ee2e7e0f6d53712caec77ff695f9)
---
 .../Source/C/TianoCompress/TianoCompress.c    | 85 +++++++++++++------
 .../Source/C/TianoCompress/TianoCompress.h    |  2 +-
 2 files changed, 60 insertions(+), 27 deletions(-)

diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c
index 046fb36a178d..4bd341e36d03 100644
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.c
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c
@@ -17,6 +17,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 **/
 
 #include "Compress.h"
+#include "Decompress.h"
 #include "TianoCompress.h"
 #include "EfiUtilityMsgs.h"
 #include "ParseInf.h"
@@ -65,6 +66,7 @@ static BOOLEAN QuietMode = FALSE;
 //
 STATIC BOOLEAN ENCODE = FALSE;
 STATIC BOOLEAN DECODE = FALSE;
+STATIC BOOLEAN UEFIMODE = FALSE;
 STATIC UINT8  *mSrc, *mDst, *mSrcUpperLimit, *mDstUpperLimit;
 STATIC UINT8  *mLevel, *mText, *mChildCount, *mBuf, mCLen[NC], mPTLen[NPT], *mLen;
 STATIC INT16  mHeap[NC + 1];
@@ -1703,6 +1705,8 @@ Returns:
   // Details Option
   //
   fprintf (stdout, "Options:\n");
+  fprintf (stdout, "  --uefi\n\
+            Enable UefiCompress, use TianoCompress when without this option\n");
   fprintf (stdout, "  -o FileName, --output FileName\n\
             File will be created to store the ouput content.\n");
   fprintf (stdout, "  -v, --verbose\n\
@@ -1822,6 +1826,13 @@ Returns:
       continue;
     }
 
+    if (stricmp(argv[0], "--uefi") == 0) {
+      UEFIMODE = TRUE;
+      argc--;
+      argv++;
+      continue;
+    }
+
     if (stricmp (argv[0], "--debug") == 0) {
       argc-=2;
       argv++;
@@ -1939,8 +1950,12 @@ Returns:
   if (DebugMode) {
     DebugMsg(UTILITY_NAME, 0, DebugLevel, "Encoding", NULL);
   }
-  Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
-  
+  if (UEFIMODE) {
+    Status = EfiCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+  } else {
+    Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+  }
+
   if (Status == EFI_BUFFER_TOO_SMALL) {
     OutBuffer = (UINT8 *) malloc (DstSize);
     if (OutBuffer == NULL) {
@@ -1949,7 +1964,11 @@ Returns:
     }
   }
 
-  Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+  if (UEFIMODE) {
+    Status = EfiCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+  } else {
+    Status = TianoCompress ((UINT8 *)FileBuffer, InputLength, OutBuffer, &DstSize);
+  }
   if (Status != EFI_SUCCESS) {
     Error (NULL, 0, 0007, "Error compressing file", NULL);
     goto ERROR;
@@ -1979,32 +1998,46 @@ Returns:
   if (DebugMode) {
     DebugMsg(UTILITY_NAME, 0, DebugLevel, "Decoding\n", NULL);
   }
-  //
-  // Get Compressed file original size
-  // 
-  Src     = (UINT8 *)FileBuffer;                     
-  OrigSize  = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);  
-  
-  //
-  // Allocate OutputBuffer
-  //
-  OutBuffer = (UINT8 *)malloc(OrigSize);
-  if (OutBuffer == NULL) {
-    Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!");
-    goto ERROR;
-   }  
 
-  Status = Decompress((VOID *)FileBuffer, (VOID *)OutBuffer, (VOID *)Scratch, 2);
-  if (Status != EFI_SUCCESS) {
-   goto ERROR; 	
+  if (UEFIMODE) {
+    Status = Extract((VOID *)FileBuffer, InputLength, (VOID *)&OutBuffer, &DstSize, 1);
+    if (Status != EFI_SUCCESS) {
+      goto ERROR;
+    }
+    fwrite(OutBuffer, (size_t)(DstSize), 1, OutputFile);
+  } else {
+    //
+    // Get Compressed file original size
+    //
+    Src     = (UINT8 *)FileBuffer;
+    OrigSize  = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
+
+    //
+    // Allocate OutputBuffer
+    //
+    OutBuffer = (UINT8 *)malloc(OrigSize);
+    if (OutBuffer == NULL) {
+      Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!");
+      goto ERROR;
+     }
+
+    Status = TDecompress((VOID *)FileBuffer, (VOID *)OutBuffer, (VOID *)Scratch, 2);
+    if (Status != EFI_SUCCESS) {
+      goto ERROR;
+    }
+    fwrite(OutBuffer, (size_t)(Scratch->mOrigSize), 1, OutputFile);
   }
-
-  fwrite(OutBuffer, (size_t)(Scratch->mOrigSize), 1, OutputFile);
   fclose(OutputFile);
   fclose(InputFile);
-  free(Scratch);
-  free(FileBuffer);
-  free(OutBuffer);
+  if (Scratch != NULL) {
+    free(Scratch);
+  }
+  if (FileBuffer != NULL) {
+    free(FileBuffer);
+  }
+  if (OutBuffer != NULL) {
+    free(OutBuffer);
+  }
 
   if (DebugMode) {
     DebugMsg(UTILITY_NAME, 0, DebugLevel, "Encoding successful!\n", NULL);
@@ -2634,7 +2667,7 @@ Done:
 
 RETURN_STATUS
 EFIAPI
-Decompress (
+TDecompress (
   IN VOID  *Source,
   IN OUT VOID    *Destination,
   IN OUT VOID    *Scratch,
diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.h b/BaseTools/Source/C/TianoCompress/TianoCompress.h
index 2971225d1b58..a5ec45a452bf 100644
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.h
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.h
@@ -427,7 +427,7 @@ Decode (
 
 RETURN_STATUS
 EFIAPI
-Decompress (
+TDecompress (
   IN VOID  *Source,
   IN OUT VOID    *Destination,
   IN OUT VOID    *Scratch,
-- 
2.19.1

From bab2ccb60c52e118bcda54c542e680b6d8fe5e33 Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Tue, 16 Oct 2018 10:06:13 +0800
Subject: [PATCH 4/7] BaseTools: Add more checker in Decompress algorithm to
 access the valid buffer (CVE FIX)

Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735
https://bugzilla.tianocore.org/show_bug.cgi?id=686

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com>
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 041d89bc0f0119df37a5fce1d0f16495ff905089)
---
 BaseTools/Source/C/Common/Decompress.c        | 23 ++++++++++++++--
 .../Source/C/TianoCompress/TianoCompress.c    | 26 ++++++++++++++++++-
 2 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/BaseTools/Source/C/Common/Decompress.c b/BaseTools/Source/C/Common/Decompress.c
index b2049bd01c5f..a87e806961e8 100644
--- a/BaseTools/Source/C/Common/Decompress.c
+++ b/BaseTools/Source/C/Common/Decompress.c
@@ -194,12 +194,16 @@ Returns:
   UINT16  Avail;
   UINT16  NextCode;
   UINT16  Mask;
+  UINT16  MaxTableLength;
 
   for (Index = 1; Index <= 16; Index++) {
     Count[Index] = 0;
   }
 
   for (Index = 0; Index < NumOfChar; Index++) {
+    if (BitLen[Index] > 16) {
+      return (UINT16) BAD_TABLE;
+    }
     Count[BitLen[Index]]++;
   }
 
@@ -237,6 +241,7 @@ Returns:
 
   Avail = NumOfChar;
   Mask  = (UINT16) (1U << (15 - TableBits));
+  MaxTableLength = (UINT16) (1U << TableBits);
 
   for (Char = 0; Char < NumOfChar; Char++) {
 
@@ -250,6 +255,9 @@ Returns:
     if (Len <= TableBits) {
 
       for (Index = Start[Len]; Index < NextCode; Index++) {
+        if (Index >= MaxTableLength) {
+          return (UINT16) BAD_TABLE;
+        }
         Table[Index] = Char;
       }
 
@@ -643,10 +651,14 @@ Returns: (VOID)
 
       BytesRemain--;
       while ((INT16) (BytesRemain) >= 0) {
-        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
         if (Sd->mOutBuf >= Sd->mOrigSize) {
           return ;
         }
+        if (DataIdx >= Sd->mOrigSize) {
+          Sd->mBadTableFlag = (UINT16) BAD_TABLE;
+          return ;
+        }
+        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
 
         BytesRemain--;
       }
@@ -684,6 +696,7 @@ Returns:
 --*/
 {
   UINT8 *Src;
+  UINT32 CompSize;
 
   *ScratchSize  = sizeof (SCRATCH_DATA);
 
@@ -692,7 +705,13 @@ Returns:
     return EFI_INVALID_PARAMETER;
   }
 
+  CompSize = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24);
   *DstSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
+
+  if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) {
+    return EFI_INVALID_PARAMETER;
+  }
+
   return EFI_SUCCESS;
 }
 
@@ -752,7 +771,7 @@ Returns:
   CompSize  = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24);
   OrigSize  = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
 
-  if (SrcSize < CompSize + 8) {
+  if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) {
     return EFI_INVALID_PARAMETER;
   }
 
diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c
index 4bd341e36d03..c6c89e3f7d36 100644
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.c
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c
@@ -1757,6 +1757,7 @@ Returns:
   SCRATCH_DATA      *Scratch;
   UINT8      *Src;
   UINT32     OrigSize;
+  UINT32     CompSize;
 
   SetUtilityName(UTILITY_NAME);
   
@@ -1765,6 +1766,7 @@ Returns:
   OutBuffer = NULL;
   Scratch   = NULL;
   OrigSize = 0;
+  CompSize = 0;
   InputLength = 0;
   InputFileName = NULL;
   OutputFileName = NULL;
@@ -2006,15 +2008,24 @@ Returns:
     }
     fwrite(OutBuffer, (size_t)(DstSize), 1, OutputFile);
   } else {
+    if (InputLength < 8){
+      Error (NULL, 0, 3000, "Invalid", "The input file %s is too small.", InputFileName);
+      goto ERROR;
+    }
     //
     // Get Compressed file original size
     //
     Src     = (UINT8 *)FileBuffer;
     OrigSize  = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
+    CompSize  = Src[0] + (Src[1] << 8) + (Src[2] <<16) + (Src[3] <<24);
 
     //
     // Allocate OutputBuffer
     //
+    if (InputLength < CompSize + 8 || (CompSize + 8) < 8) {
+      Error (NULL, 0, 3000, "Invalid", "The input file %s data is invalid.", InputFileName);
+      goto ERROR;
+    }
     OutBuffer = (UINT8 *)malloc(OrigSize);
     if (OutBuffer == NULL) {
       Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!");
@@ -2204,12 +2215,16 @@ Returns:
   UINT16  Mask;
   UINT16  WordOfStart;
   UINT16  WordOfCount;
+  UINT16  MaxTableLength;
 
   for (Index = 0; Index <= 16; Index++) {
     Count[Index] = 0;
   }
 
   for (Index = 0; Index < NumOfChar; Index++) {
+    if (BitLen[Index] > 16) {
+      return (UINT16) BAD_TABLE;
+    }
     Count[BitLen[Index]]++;
   }
 
@@ -2253,6 +2268,7 @@ Returns:
 
   Avail = NumOfChar;
   Mask  = (UINT16) (1U << (15 - TableBits));
+  MaxTableLength = (UINT16) (1U << TableBits);
 
   for (Char = 0; Char < NumOfChar; Char++) {
 
@@ -2266,6 +2282,9 @@ Returns:
     if (Len <= TableBits) {
 
       for (Index = Start[Len]; Index < NextCode; Index++) {
+        if (Index >= MaxTableLength) {
+          return (UINT16) BAD_TABLE;
+        }
         Table[Index] = Char;
       }
 
@@ -2650,11 +2669,16 @@ Returns: (VOID)
       DataIdx     = Sd->mOutBuf - DecodeP (Sd) - 1;
 
       BytesRemain--;
+
       while ((INT16) (BytesRemain) >= 0) {
-        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
         if (Sd->mOutBuf >= Sd->mOrigSize) {
           goto Done ;
         }
+        if (DataIdx >= Sd->mOrigSize) {
+          Sd->mBadTableFlag = (UINT16) BAD_TABLE;
+          goto Done ;
+        }
+        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
 
         BytesRemain--;
       }
-- 
2.19.1

From 75226c93dbd1893d55f12ee6a8578694c28f8005 Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Fri, 9 Nov 2018 07:58:14 +0800
Subject: [PATCH 5/7] BaseTools: Fix UEFI and Tiano Decompression logic issue

https://bugzilla.tianocore.org/show_bug.cgi?id=1317

This is a regression issue caused by 041d89bc0f0119df37a5fce1d0f16495ff905089.
In Decode() function, once mOutBuf is fully filled, Decode() should return.
Current logic misses the checker of mOutBuf after while() loop.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit 5e45a1fdcfbf9b2b389122eb97475148594625f8)
---
 BaseTools/Source/C/Common/Decompress.c           | 6 ++++++
 BaseTools/Source/C/TianoCompress/TianoCompress.c | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/BaseTools/Source/C/Common/Decompress.c b/BaseTools/Source/C/Common/Decompress.c
index a87e806961e8..ed08545918b4 100644
--- a/BaseTools/Source/C/Common/Decompress.c
+++ b/BaseTools/Source/C/Common/Decompress.c
@@ -662,6 +662,12 @@ Returns: (VOID)
 
         BytesRemain--;
       }
+      //
+      // Once mOutBuf is fully filled, directly return
+      //
+      if (Sd->mOutBuf >= Sd->mOrigSize) {
+        return ;
+      }
     }
   }
 
diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c
index c6c89e3f7d36..c6053e79738d 100644
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.c
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c
@@ -2682,6 +2682,12 @@ Returns: (VOID)
 
         BytesRemain--;
       }
+      //
+      // Once mOutBuf is fully filled, directly return
+      //
+      if (Sd->mOutBuf >= Sd->mOrigSize) {
+        goto Done ;
+      }
     }
   }
 
-- 
2.19.1

From d8373748447f344bf4ca6ed46421dea4643570a0 Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Fri, 9 Nov 2018 07:58:15 +0800
Subject: [PATCH 6/7] MdePkg BaseUefiDecompressLib: Fix UEFI Decompression
 logic issue

https://bugzilla.tianocore.org/show_bug.cgi?id=1317

This is a regression issue caused by 2ec7953d49677142c5f7552e9e3d96fb406ba0c4.
In Decode() function, once mOutBuf is fully filled, Decode() should return.
Current logic misses the checker of mOutBuf after while() loop.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Liming Gao <liming.gao@intel.com>
Cc: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit 1c4cecc9fd314de0dce8125b0d4b45967637a401)
---
 .../Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c   | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
index 0c6b1fe4ee83..8c30e971f95b 100644
--- a/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
+++ b/MdePkg/Library/BaseUefiDecompressLib/BaseUefiDecompressLib.c
@@ -641,6 +641,12 @@ Decode (
 
         BytesRemain--;
       }
+      //
+      // Once mOutBuf is fully filled, directly return
+      //
+      if (Sd->mOutBuf >= Sd->mOrigSize) {
+        goto Done;
+      }
     }
   }
 
-- 
2.19.1

From 3541b6fb4d73a1f50be4788b5f14fb0e4e2f7f24 Mon Sep 17 00:00:00 2001
From: Liming Gao <liming.gao@intel.com>
Date: Fri, 9 Nov 2018 07:58:16 +0800
Subject: [PATCH 7/7] IntelFrameworkModulePkg: Fix UEFI and Tiano Decompression
 logic issue

https://bugzilla.tianocore.org/show_bug.cgi?id=1317

This is a regression issue caused by 684db6da64bc7b5faee4e1174e801c245f563b5c.
In Decode() function, once mOutBuf is fully filled, Decode() should return.
Current logic misses the checker of mOutBuf after while() loop.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit ade71c52a49d659b20c0b433fb11ddb4f4f543c4)
---
 .../BaseUefiTianoCustomDecompressLib.c                      | 6 ++++++
 1 file changed, 6 insertions(+)

Places

File ovmf-bsc1115917-bounds-checking-for-ueficompress.patch of Package ovmf (Revision f021fadb8b3a731db3bbb6d17cc4d2c2)

Places