Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-25 23:06:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

efi_selftest: check for buffer overflow in efi_get_variable

Browse source 
Allocate a buffer on the stack instead of an array of uninitialized
pointers; check if GetVariable writes past the end of the buffer.

Signed-off-by: Ivan Gorinov <ivan.gorinov@intel.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
This commit is contained in:
Ivan Gorinov 2018-05-25 10:45:09 -07:00 • committed by Alexander Graf
parent 7f474ef6cc
commit fe5bc23f43
1 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
lib/efi_selftest/efi_selftest_variables.c
View file

@ -49,7 +49,7 @@ static int execute(void)
u32 attr; u32 attr;
u8 v[16] = {0x5d, 0xd1, 0x5e, 0x51, 0x5a, 0x05, 0xc7, 0x0c, u8 v[16] = {0x5d, 0xd1, 0x5e, 0x51, 0x5a, 0x05, 0xc7, 0x0c,
0x35, 0x4a, 0xae, 0x87, 0xa5, 0xdf, 0x0f, 0x65,}; 0x35, 0x4a, 0xae, 0x87, 0xa5, 0xdf, 0x0f, 0x65,};
u8 *data[EFI_ST_MAX_DATA_SIZE]; u8 data[EFI_ST_MAX_DATA_SIZE];
u16 varname[EFI_ST_MAX_VARNAME_SIZE]; u16 varname[EFI_ST_MAX_VARNAME_SIZE];
int flag; int flag;
efi_guid_t guid; efi_guid_t guid;
@ -72,6 +72,22 @@ static int execute(void)
efi_st_error("SetVariable failed\n"); efi_st_error("SetVariable failed\n");
return EFI_ST_FAILURE; return EFI_ST_FAILURE;
} }
data[3] = 0xff;
len = 3;
ret = runtime->get_variable(L"efi_st_var0", &guid_vendor0,
&attr, &len, data);
if (ret != EFI_SUCCESS) {
efi_st_error("GetVariable failed\n");
return EFI_ST_FAILURE;
}
if (efi_st_memcmp(data, v + 4, 3)) {
efi_st_error("GetVariable returned wrong value\n");
return EFI_ST_FAILURE;
}
if (data[3] != 0xff) {
efi_st_error("GetVariable wrote past the end of the buffer\n");
return EFI_ST_FAILURE;
}
/* Set variable 1 */ /* Set variable 1 */
ret = runtime->set_variable(L"efi_st_var1", &guid_vendor1, ret = runtime->set_variable(L"efi_st_var1", &guid_vendor1,
EFI_VARIABLE_BOOTSERVICE_ACCESS, EFI_VARIABLE_BOOTSERVICE_ACCESS,