efi_selftest: check for buffer overflow in efi_get_variable
PATCH v2 1/1 efi_selftest: check for buffer overflow in efi_get_variable
Allocate a buffer on the stack instead of an array of uninitialized pointers; check if GetVariable writes past the end of the buffer.
Signed-off-by Ivan Gorinov <[email protected]>
--- lib/efi_selftest/efi_selftest_variables.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
lib/efi_selftest/efi_selftest_variables.c +17 -1
@@ -49,7 +49,7 @@ static int execute(void)u32 attr;u8 v[16 ] = {0x5d ,0xd1 ,0x5e ,0x51 ,0x5a ,0x05 ,0xc7 ,0x0c ,0x35 ,0x4a ,0xae ,0x87 ,0xa5 ,0xdf ,0x0f ,0x65 ,}; -u8 *data[EFI_ST_MAX_DATA_SIZE ]; +u8 data[EFI_ST_MAX_DATA_SIZE ];u16 varname[EFI_ST_MAX_VARNAME_SIZE ];int flag;efi_guid_t guid;
@@ -72,6 +72,22 @@ static int execute(void)efi_st_error ("SetVariable failed\n" );return EFI_ST_FAILURE ; } + data[3 ] =0xff ; + len =3 ; + ret = runtime->get_variable (L"efi_st_var0" , &guid_vendor0, + &attr, &len, data); +if (ret !=EFI_SUCCESS ) { +efi_st_error ("GetVariable failed\n" ); +return EFI_ST_FAILURE ; + } +if (efi_st_memcmp (data, v +4 ,3 )) { +efi_st_error ("GetVariable returned wrong value\n" ); +return EFI_ST_FAILURE ; + } +if (data[3 ] !=0xff ) { +efi_st_error ("GetVariable wrote past the end of the buffer\n" ); +return EFI_ST_FAILURE ; + }/* Set variable 1 */ ret = runtime->set_variable(L"efi_st_var1", &guid_vendor1, EFI_VARIABLE_BOOTSERVICE_ACCESS,
Signature · 1 line
2.7.4
Alexander Graf
AppliedPATCH v2 1/1 efi_selftest: check for buffer overflow in efi_get_variable
Quoted 4 lines
Allocate a buffer on the stack instead of an array of uninitialized pointers; check if GetVariable writes past the end of the buffer.
Signed-off-by Ivan Gorinov <[email protected]>
Thanks, applied to efi-next
Alex