Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix incorrect error handling in callers of efidp_node_size() #264

Merged
merged 9 commits into from
Mar 6, 2024
+76 −31
Merged

Fix incorrect error handling in callers of efidp_node_size() #264

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ed17f9f
safemath: fix users of is_null()
vathpela Mar 5, 2024
606faed
Fix wrong variadic initialization
vathpela Mar 5, 2024
8a24122
src/dp-media.c: fix overruns on efidp_node_size calls
lsandov1 Mar 5, 2024
812f20b
dp-media: more efidp_node_size() fixups.
vathpela Mar 6, 2024
d0fa2b8
dp.h: Fix incorrect efidp_node_size() error handling
vathpela Mar 6, 2024
400bad7
efidp_format_device_path(): fix efidp_node_size() return value handling.
vathpela Mar 6, 2024
57d1023
dp-message: fix efidp_node_size() error checking
vathpela Mar 6, 2024
4e09015
dp-acpi.c: fix incorrect error handling of efidp_node_size() invocations
vathpela Mar 6, 2024
b580d3b
dp-hw.c: fix incorrect error handling of efidp_node_size() invocations
vathpela Mar 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 1 addition & 6 deletions src/creator.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,12 +221,7 @@ efi_va_generate_file_device_path_from_esp(uint8_t *buf, ssize_t size,
debug("EFIBOOT_ABBREV_EDD10");

if (options & EFIBOOT_ABBREV_EDD10) {
va_list aq;
va_copy(aq, ap);

dev->edd10_devicenum = va_arg(aq, uint32_t);

va_end(aq);
dev->edd10_devicenum = va_arg(ap, uint32_t);
}

if (!(options & (EFIBOOT_ABBREV_FILE|EFIBOOT_ABBREV_HD))
Expand Down
11 changes: 9 additions & 2 deletions src/dp-acpi.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,10 +101,17 @@ _format_acpi_dn(unsigned char *buf, size_t size, const_efidp dp)
return off;
} else if (dp->subtype != EFIDP_ACPI_HID_EX &&
dp->subtype != EFIDP_ACPI_HID) {
ssize_t limit = efidp_node_size(dp);

debug("DP subtype %d, formatting as ACPI Path", dp->subtype);
if (SUB(limit, 4, &limit) ||
DIV(limit, 2, &limit) ||
limit < 0) {
efi_error("bad DP node size");
return -1;
}
format(buf, size, off, "AcpiPath", "AcpiPath(%d,", dp->subtype);
format_hex(buf, size, off, "AcpiPath", (uint8_t *)dp+4,
(efidp_node_size(dp)-4) / 2);
format_hex(buf, size, off, "AcpiPath", (uint8_t *)dp+4, limit);
format(buf, size, off, "AcpiPath", ")");
return off;
} else if (dp->subtype == EFIDP_ACPI_HID_EX) {
Expand Down
13 changes: 10 additions & 3 deletions src/dp-hw.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,13 +58,20 @@ _format_hw_dn(unsigned char *buf, size_t size, const_efidp dp)
format(buf, size, off, "BMC", "BMC(%d,0x%"PRIx64")",
dp->bmc.interface_type, dp->bmc.base_addr);
break;
default:
default: {
ssize_t sz = efidp_node_size(dp);

if (SUB(sz, 4, &sz) ||
sz < 0) {
efi_error("bad DP node size");
return -1;
}
format(buf, size, off, "Hardware",
"HardwarePath(%d,", dp->subtype);
format_hex(buf, size, off, "Hardware", (uint8_t *)dp+4,
efidp_node_size(dp)-4);
format_hex(buf, size, off, "Hardware", (uint8_t *)dp+4, sz);
format(buf, size, off, "Hardware", ")");
break;
}
}
return off;
}
Expand Down
23 changes: 18 additions & 5 deletions src/dp-media.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,14 @@ _format_media_dn(unsigned char *buf, size_t size, const_efidp dp)
format_vendor(buf, size, off, "VenMedia", dp);
break;
case EFIDP_MEDIA_FILE: {
size_t limit = (efidp_node_size(dp)
- offsetof(efidp_file, name)) / 2;
ssize_t limit = efidp_node_size(dp);
size_t offset = offsetof(efidp_usb_wwid, serial_number);
if (limit < 0 ||
SUB(limit, offset, &limit) ||
DIV(limit, 2, &limit)) {
efi_error("bad DP node size");
return -1;
}
format_ucs2(buf, size, off, "File", dp->file.name, limit);
break;
}
Expand Down Expand Up @@ -126,12 +132,19 @@ _format_media_dn(unsigned char *buf, size_t size, const_efidp dp)
format(buf, size, off, "Ramdisk", ")");
break;
}
default:
default: {
ssize_t limit = efidp_node_size(dp);
if (limit < 0 ||
SUB(limit, 4, &limit) ||
DIV(limit, 2, &limit)) {
efi_error("bad DP node size");
return -1;
}
format(buf, size, off, "Media", "MediaPath(%d,", dp->subtype);
format_hex(buf, size, off, "Media", (uint8_t *)dp+4,
(efidp_node_size(dp)-4) / 2);
format_hex(buf, size, off, "Media", (uint8_t *)dp+4, limit);
format(buf,size,off, "Media",")");
break;
}
}
return off;
}
Expand Down
23 changes: 17 additions & 6 deletions src/dp-message.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -504,9 +504,14 @@ _format_message_dn(unsigned char *buf, size_t size, const_efidp dp)
format_helper(format_usb_class, buf, size, off, "UsbClass", dp);
break;
case EFIDP_MSG_USB_WWID: {
size_t limit = (efidp_node_size(dp)
- offsetof(efidp_usb_wwid, serial_number))
/ 2;
ssize_t limit = efidp_node_size(dp);
size_t offset = offsetof(efidp_usb_wwid, serial_number);
if (limit <= 0 ||
SUB(limit, offset, &limit) ||
DIV(limit, 2, &limit)) {
efi_error("bad DP node size");
return -1;
}
format(buf, size, off, "UsbWwid",
"UsbWwid(%"PRIx16",%"PRIx16",%d,",
dp->usb_wwid.vendor_id, dp->usb_wwid.product_id,
Expand Down Expand Up @@ -633,12 +638,18 @@ _format_message_dn(unsigned char *buf, size_t size, const_efidp dp)
format_guid(buf, size, off, "NVDIMM", &dp->nvdimm.uuid);
format(buf, size, off, "NVDIMM", ")");
break;
default:
default: {
ssize_t limit = efidp_node_size(dp);
if (SUB(limit, 4, &limit) ||
limit < 0) {
efi_error("bad DP node size");
return -1;
}
format(buf, size, off, "Msg", "Msg(%d,", dp->subtype);
format_hex(buf, size, off, "Msg", (uint8_t *)dp+4,
efidp_node_size(dp)-4);
format_hex(buf, size, off, "Msg", (uint8_t *)dp+4, limit);
format(buf, size, off, "Msg", ")");
break;
}
}
return off;
}
Expand Down
15 changes: 11 additions & 4 deletions src/dp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,12 @@ efidp_format_device_path(unsigned char *buf, size_t size, const_efidp dp,
memset(buf, 0, size);

while (limit) {
ssize_t sz = efidp_node_size(dp);
if (SUB(sz, 4, &sz) ||
sz < 0) {
efi_error("bad DP node size");
return -1;
}
if (limit >= 0 && (limit < 4 || efidp_node_size(dp) > limit)) {
if (off)
return off;
Expand Down Expand Up @@ -339,9 +345,9 @@ efidp_format_device_path(unsigned char *buf, size_t size, const_efidp dp,
if (dp->subtype != EFIDP_BIOS_BOOT) {
format(buf, size, off, "BbsPath",
"BbsPath(%d,", dp->subtype);
format_hex(buf, size, off, "BbsPath",
(uint8_t *)dp+4,
efidp_node_size(dp)-4);
if (sz > 0)
format_hex(buf, size, off, "BbsPath",
(uint8_t *)dp+4, sz);
format(buf, size, off, "BbsPath", ")");
break;
}
Expand Down Expand Up @@ -371,8 +377,9 @@ efidp_format_device_path(unsigned char *buf, size_t size, const_efidp dp,
default:
format(buf, size, off, "Path",
"Path(%d,%d,", dp->type, dp->subtype);
if (sz > 0)
format_hex(buf, size, off, "Path", (uint8_t *)dp + 4,
efidp_node_size(dp) - 4);
sz);
format(buf, size, off, "Path", ")");
break;
}
Expand Down
11 changes: 8 additions & 3 deletions src/dp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,9 +101,14 @@ format_vendor_helper(unsigned char *buf, size_t size, char *label,
const_efidp dp)
{
ssize_t off = 0;
ssize_t bytes = efidp_node_size(dp)
- sizeof (efidp_header)
- sizeof (efi_guid_t);
ssize_t bytes = efidp_node_size(dp);

if (SUB(bytes, sizeof (efidp_header), &bytes) ||
SUB(bytes, sizeof (efi_guid_t), &bytes) ||
bytes < 0) {
efi_error("bad DP node size");
return -1;
}

format(buf, size, off, label, "%s(", label);
format_guid(buf, size, off, label, &dp->hw_vendor.vendor_guid);
Expand Down
4 changes: 2 additions & 2 deletions src/safemath.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
#define DIV(a, b, res) ({ \
bool ret_ = true; \
if ((b) != 0) { \
if (!is_null(res)) \
if (!(res == NULL)) \
(*(res)) = (a) / (b); \
ret_ = false; \
} else { \
Expand All @@ -44,7 +44,7 @@
* These really just exists for chaining results easily with || in an expr
*/
#define MOD(a, b, res) ({ \
if (!is_null(res)) \
if (!(res == NULL)) \
(*(res)) = (a) % (b); \
false; \
})
Expand Down
Loading