Skip to content

Commit 041d89b

Browse files
committed
BaseTools: Add more checker in Decompress algorithm to access the valid buffer (CVE FIX)
Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735 https://bugzilla.tianocore.org/show_bug.cgi?id=686 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Holtsclaw Brent <[email protected]> Signed-off-by: Liming Gao <[email protected]> Reviewed-by: Star Zeng <[email protected]> Acked-by: Laszlo Ersek <[email protected]>
1 parent 684db6d commit 041d89b

File tree

2 files changed

+46
-3
lines changed

2 files changed

+46
-3
lines changed

BaseTools/Source/C/Common/Decompress.c

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,12 +194,16 @@ Routine Description:
194194
UINT16 Avail;
195195
UINT16 NextCode;
196196
UINT16 Mask;
197+
UINT16 MaxTableLength;
197198

198199
for (Index = 1; Index <= 16; Index++) {
199200
Count[Index] = 0;
200201
}
201202

202203
for (Index = 0; Index < NumOfChar; Index++) {
204+
if (BitLen[Index] > 16) {
205+
return (UINT16) BAD_TABLE;
206+
}
203207
Count[BitLen[Index]]++;
204208
}
205209

@@ -237,6 +241,7 @@ Routine Description:
237241

238242
Avail = NumOfChar;
239243
Mask = (UINT16) (1U << (15 - TableBits));
244+
MaxTableLength = (UINT16) (1U << TableBits);
240245

241246
for (Char = 0; Char < NumOfChar; Char++) {
242247

@@ -250,6 +255,9 @@ Routine Description:
250255
if (Len <= TableBits) {
251256

252257
for (Index = Start[Len]; Index < NextCode; Index++) {
258+
if (Index >= MaxTableLength) {
259+
return (UINT16) BAD_TABLE;
260+
}
253261
Table[Index] = Char;
254262
}
255263

@@ -643,10 +651,14 @@ Returns: (VOID)
643651

644652
BytesRemain--;
645653
while ((INT16) (BytesRemain) >= 0) {
646-
Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
647654
if (Sd->mOutBuf >= Sd->mOrigSize) {
648655
return ;
649656
}
657+
if (DataIdx >= Sd->mOrigSize) {
658+
Sd->mBadTableFlag = (UINT16) BAD_TABLE;
659+
return ;
660+
}
661+
Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
650662

651663
BytesRemain--;
652664
}
@@ -684,6 +696,7 @@ Routine Description:
684696
--*/
685697
{
686698
UINT8 *Src;
699+
UINT32 CompSize;
687700

688701
*ScratchSize = sizeof (SCRATCH_DATA);
689702

@@ -692,7 +705,13 @@ Routine Description:
692705
return EFI_INVALID_PARAMETER;
693706
}
694707

708+
CompSize = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24);
695709
*DstSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
710+
711+
if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) {
712+
return EFI_INVALID_PARAMETER;
713+
}
714+
696715
return EFI_SUCCESS;
697716
}
698717

@@ -752,7 +771,7 @@ Routine Description:
752771
CompSize = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24);
753772
OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
754773

755-
if (SrcSize < CompSize + 8) {
774+
if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) {
756775
return EFI_INVALID_PARAMETER;
757776
}
758777

BaseTools/Source/C/TianoCompress/TianoCompress.c

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1757,6 +1757,7 @@ Routine Description:
17571757
SCRATCH_DATA *Scratch;
17581758
UINT8 *Src;
17591759
UINT32 OrigSize;
1760+
UINT32 CompSize;
17601761

17611762
SetUtilityName(UTILITY_NAME);
17621763

@@ -1765,6 +1766,7 @@ Routine Description:
17651766
OutBuffer = NULL;
17661767
Scratch = NULL;
17671768
OrigSize = 0;
1769+
CompSize = 0;
17681770
InputLength = 0;
17691771
InputFileName = NULL;
17701772
OutputFileName = NULL;
@@ -2006,15 +2008,24 @@ Routine Description:
20062008
}
20072009
fwrite(OutBuffer, (size_t)(DstSize), 1, OutputFile);
20082010
} else {
2011+
if (InputLength < 8){
2012+
Error (NULL, 0, 3000, "Invalid", "The input file %s is too small.", InputFileName);
2013+
goto ERROR;
2014+
}
20092015
//
20102016
// Get Compressed file original size
20112017
//
20122018
Src = (UINT8 *)FileBuffer;
20132019
OrigSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);
2020+
CompSize = Src[0] + (Src[1] << 8) + (Src[2] <<16) + (Src[3] <<24);
20142021

20152022
//
20162023
// Allocate OutputBuffer
20172024
//
2025+
if (InputLength < CompSize + 8 || (CompSize + 8) < 8) {
2026+
Error (NULL, 0, 3000, "Invalid", "The input file %s data is invalid.", InputFileName);
2027+
goto ERROR;
2028+
}
20182029
OutBuffer = (UINT8 *)malloc(OrigSize);
20192030
if (OutBuffer == NULL) {
20202031
Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!");
@@ -2204,12 +2215,16 @@ Routine Description:
22042215
UINT16 Mask;
22052216
UINT16 WordOfStart;
22062217
UINT16 WordOfCount;
2218+
UINT16 MaxTableLength;
22072219

22082220
for (Index = 0; Index <= 16; Index++) {
22092221
Count[Index] = 0;
22102222
}
22112223

22122224
for (Index = 0; Index < NumOfChar; Index++) {
2225+
if (BitLen[Index] > 16) {
2226+
return (UINT16) BAD_TABLE;
2227+
}
22132228
Count[BitLen[Index]]++;
22142229
}
22152230

@@ -2253,6 +2268,7 @@ Routine Description:
22532268

22542269
Avail = NumOfChar;
22552270
Mask = (UINT16) (1U << (15 - TableBits));
2271+
MaxTableLength = (UINT16) (1U << TableBits);
22562272

22572273
for (Char = 0; Char < NumOfChar; Char++) {
22582274

@@ -2266,6 +2282,9 @@ Routine Description:
22662282
if (Len <= TableBits) {
22672283

22682284
for (Index = Start[Len]; Index < NextCode; Index++) {
2285+
if (Index >= MaxTableLength) {
2286+
return (UINT16) BAD_TABLE;
2287+
}
22692288
Table[Index] = Char;
22702289
}
22712290

@@ -2650,11 +2669,16 @@ Returns: (VOID)
26502669
DataIdx = Sd->mOutBuf - DecodeP (Sd) - 1;
26512670

26522671
BytesRemain--;
2672+
26532673
while ((INT16) (BytesRemain) >= 0) {
2654-
Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
26552674
if (Sd->mOutBuf >= Sd->mOrigSize) {
26562675
goto Done ;
26572676
}
2677+
if (DataIdx >= Sd->mOrigSize) {
2678+
Sd->mBadTableFlag = (UINT16) BAD_TABLE;
2679+
goto Done ;
2680+
}
2681+
Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
26582682

26592683
BytesRemain--;
26602684
}

0 commit comments

Comments
 (0)