From nobody Tue Apr 23 21:10:15 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail(p=none dis=none) header.from=intel.com Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1528337347107674.7484629084942; Wed, 6 Jun 2018 19:09:07 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 3982B211435B5; Wed, 6 Jun 2018 19:09:06 -0700 (PDT) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id B43D0210D97B1 for ; Wed, 6 Jun 2018 19:09:04 -0700 (PDT) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Jun 2018 19:09:04 -0700 Received: from shwdeopenpsi168.ccr.corp.intel.com ([10.239.158.129]) by orsmga002.jf.intel.com with ESMTP; 06 Jun 2018 19:09:03 -0700 X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.20; helo=mga02.intel.com; envelope-from=yonghong.zhu@intel.com; receiver=edk2-devel@lists.01.org X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.49,485,1520924400"; d="scan'208";a="64963305" From: Yonghong Zhu To: edk2-devel@lists.01.org Date: Thu, 7 Jun 2018 10:08:59 +0800 Message-Id: <1528337339-1132-1-git-send-email-yonghong.zhu@intel.com> X-Mailer: git-send-email 2.6.1.windows.1 Subject: [edk2] [Patch] BaseTools: Fix Section header size larger than elf file size bug X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Yunhua Feng , Liming Gao MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" From: Yunhua Feng Add the logic to handle the case that Section header size larger than elf file size. Cc: Liming Gao Cc: Yonghong Zhu Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Yunhua Feng Reviewed-by: Liming Gao --- BaseTools/Source/C/GenFw/Elf32Convert.c | 3 +++ BaseTools/Source/C/GenFw/Elf64Convert.c | 3 +++ BaseTools/Source/C/GenFw/ElfConvert.c | 20 ++++++++++++++++---- BaseTools/Source/C/GenFw/ElfConvert.h | 3 ++- 4 files changed, 24 insertions(+), 5 deletions(-) diff --git a/BaseTools/Source/C/GenFw/Elf32Convert.c b/BaseTools/Source/C/G= enFw/Elf32Convert.c index e0f6491..e26b10b 100644 --- a/BaseTools/Source/C/GenFw/Elf32Convert.c +++ b/BaseTools/Source/C/GenFw/Elf32Convert.c @@ -672,10 +672,13 @@ WriteSections32 ( Elf_Shdr *Shdr =3D GetShdrByIndex(Idx); if ((*Filter)(Shdr)) { switch (Shdr->sh_type) { case SHT_PROGBITS: /* Copy. */ + if (Shdr->sh_offset + Shdr->sh_size > mFileBufferSize) { + return FALSE; + } memcpy(mCoffFile + mCoffSectionsOffset[Idx], (UINT8*)mEhdr + Shdr->sh_offset, Shdr->sh_size); break; =20 diff --git a/BaseTools/Source/C/GenFw/Elf64Convert.c b/BaseTools/Source/C/G= enFw/Elf64Convert.c index 9e68d22..cc0c2cf 100644 --- a/BaseTools/Source/C/GenFw/Elf64Convert.c +++ b/BaseTools/Source/C/GenFw/Elf64Convert.c @@ -668,10 +668,13 @@ WriteSections64 ( Elf_Shdr *Shdr =3D GetShdrByIndex(Idx); if ((*Filter)(Shdr)) { switch (Shdr->sh_type) { case SHT_PROGBITS: /* Copy. */ + if (Shdr->sh_offset + Shdr->sh_size > mFileBufferSize) { + return FALSE; + } memcpy(mCoffFile + mCoffSectionsOffset[Idx], (UINT8*)mEhdr + Shdr->sh_offset, (size_t) Shdr->sh_size); break; =20 diff --git a/BaseTools/Source/C/GenFw/ElfConvert.c b/BaseTools/Source/C/Gen= Fw/ElfConvert.c index 17913ff..6844c69 100644 --- a/BaseTools/Source/C/GenFw/ElfConvert.c +++ b/BaseTools/Source/C/GenFw/ElfConvert.c @@ -1,9 +1,9 @@ /** @file Elf convert solution =20 -Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.
+Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.
=20 This program and the accompanying materials are licensed and made availabl= e=20 under the terms and conditions of the BSD License which accompanies this=20 distribution. The full text of the license may be found at=20 http://opensource.org/licenses/bsd-license.php @@ -56,10 +56,15 @@ UINT32 mCoffOffset; // Offset in Coff file of headers and sections. // UINT32 mTableOffset; =20 // +//mFileBufferSize +// +UINT32 mFileBufferSize; + +// //************************************************************************= ***** // Common ELF Functions //************************************************************************= ***** // =20 @@ -171,10 +176,11 @@ ConvertElf ( ) { ELF_FUNCTION_TABLE ElfFunctions; UINT8 EiClass; =20 + mFileBufferSize =3D *FileLength; // // Determine ELF type and set function table pointer correctly. // VerboseMsg ("Check Elf Image Header"); EiClass =3D (*FileBuffer)[EI_CLASS]; @@ -199,13 +205,19 @@ ConvertElf ( =20 // // Write and relocate sections. // VerboseMsg ("Write and relocate sections."); - ElfFunctions.WriteSections (SECTION_TEXT); - ElfFunctions.WriteSections (SECTION_DATA); - ElfFunctions.WriteSections (SECTION_HII); + if (!ElfFunctions.WriteSections (SECTION_TEXT)) { + return FALSE; + } + if (!ElfFunctions.WriteSections (SECTION_DATA)) { + return FALSE; + } + if (!ElfFunctions.WriteSections (SECTION_HII)) { + return FALSE; + } =20 // // Translate and write relocations. // VerboseMsg ("Translate and write relocations."); diff --git a/BaseTools/Source/C/GenFw/ElfConvert.h b/BaseTools/Source/C/Gen= Fw/ElfConvert.h index abf434d..fc8c63f 100644 --- a/BaseTools/Source/C/GenFw/ElfConvert.h +++ b/BaseTools/Source/C/GenFw/ElfConvert.h @@ -1,9 +1,9 @@ /** @file Header file for Elf convert solution =20 -Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.
+Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.
=20 This program and the accompanying materials are licensed and made availabl= e=20 under the terms and conditions of the BSD License which accompanies this=20 distribution. The full text of the license may be found at=20 http://opensource.org/licenses/bsd-license.php @@ -27,10 +27,11 @@ extern UINT32 mCoffOffset; extern CHAR8 *mInImageName; extern UINT32 mImageTimeStamp; extern UINT8 *mCoffFile; extern UINT32 mTableOffset; extern UINT32 mOutImageType; +extern UINT32 mFileBufferSize; =20 // // Common EFI specific data. // #define ELF_HII_SECTION_NAME ".hii" --=20 2.6.1.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel