summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* SecurityPkg/OpalPWSupportLib: [CVE-2017-5753] Fix bounds check bypassUDK2015Hao Wu2018-11-211-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194 Speculative execution is used by processor to avoid having to wait for data to arrive from memory, or for previous operations to finish, the processor may speculate as to what will be executed. If the speculation is incorrect, the speculatively executed instructions might leave hints such as which memory locations have been brought into cache. Malicious actors can use the bounds check bypass method (code gadgets with controlled external inputs) to infer data values that have been used in speculative operations to reveal secrets which should not otherwise be accessed. This commit will focus on the SMI handler(s) registered within the OpalPasswordSupportLib and insert AsmLfence API to mitigate the bounds check bypass issue. For SMI handler SmmOpalPasswordHandler(): Under "case SMM_FUNCTION_SET_OPAL_PASSWORD:", '&DeviceBuffer->OpalDevicePath' can points to a potential cross boundary access of the 'CommBuffer' (controlled external inputs) during speculative execution. This cross boundary access pointer is later passed as parameter 'DevicePath' into function OpalSavePasswordToSmm(). Within function OpalSavePasswordToSmm(), 'DevicePathLen' is an access to the content in 'DevicePath' and can be inferred by code: "CompareMem (&List->OpalDevicePath, DevicePath, DevicePathLen)". One can observe which part of the content within either '&List->OpalDevicePath' or 'DevicePath' was brought into cache to possibly reveal the value of 'DevicePathLen'. Hence, this commit adds a AsmLfence() after the boundary/range checks of 'CommBuffer' to prevent the speculative execution. A more detailed explanation of the purpose of commit is under the 'Bounds check bypass mitigation' section of the below link: https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation And the document at: https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf Cc: Star Zeng <star.zeng@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* MdeModulePkg/SmmCorePerfLib: [CVE-2017-5753] Fix bounds check bypassHao Wu2018-11-211-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194 Speculative execution is used by processor to avoid having to wait for data to arrive from memory, or for previous operations to finish, the processor may speculate as to what will be executed. If the speculation is incorrect, the speculatively executed instructions might leave hints such as which memory locations have been brought into cache. Malicious actors can use the bounds check bypass method (code gadgets with controlled external inputs) to infer data values that have been used in speculative operations to reveal secrets which should not otherwise be accessed. This commit will focus on the SMI handler(s) registered within the SmmCorePerformanceLib and insert AsmLfence API to mitigate the bounds check bypass issue. For SMI handler SmmPerformanceHandlerEx(): Under "case SMM_PERF_FUNCTION_GET_GAUGE_DATA :", 'SmmPerfCommData->LogEntryKey' can be a potential cross boundary access of the 'CommBuffer' (controlled external inputs) during speculative execution. This cross boundary access is then assign to parameter 'LogEntryKey'. And the value of 'LogEntryKey' can be inferred by code: CopyMem ( (UINT8 *) &GaugeDataEx[Index], (UINT8 *) &GaugeEntryExArray[LogEntryKey++], sizeof (GAUGE_DATA_ENTRY_EX) ); One can observe which part of the content within 'GaugeEntryExArray' was brought into cache to possibly reveal the value of 'LogEntryKey'. Hence, this commit adds a AsmLfence() after the boundary/range checks of 'CommBuffer' to prevent the speculative execution. And there is 1 similar case for SMI handler SmmPerformanceHandler() as well. This commit also handles it. A more detailed explanation of the purpose of commit is under the 'Bounds check bypass mitigation' section of the below link: https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation And the document at: https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com>
* UefiCpuPkg/PiSmmCpuDxeSmm: [CVE-2017-5753] Fix bounds check bypassHao Wu2018-11-211-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194 Speculative execution is used by processor to avoid having to wait for data to arrive from memory, or for previous operations to finish, the processor may speculate as to what will be executed. If the speculation is incorrect, the speculatively executed instructions might leave hints such as which memory locations have been brought into cache. Malicious actors can use the bounds check bypass method (code gadgets with controlled external inputs) to infer data values that have been used in speculative operations to reveal secrets which should not otherwise be accessed. It is possible for SMI handler(s) to call EFI_SMM_CPU_PROTOCOL service ReadSaveState() and use the content in the 'CommBuffer' (controlled external inputs) as the 'CpuIndex'. So this commit will insert AsmLfence API to mitigate the bounds check bypass issue within SmmReadSaveState(). For SmmReadSaveState(): The 'CpuIndex' will be passed into function ReadSaveStateRegister(). And then in to ReadSaveStateRegisterByIndex(). With the call: ReadSaveStateRegisterByIndex ( CpuIndex, SMM_SAVE_STATE_REGISTER_IOMISC_INDEX, sizeof(IoMisc.Uint32), &IoMisc.Uint32 ); The 'IoMisc' can be a cross boundary access during speculative execution. Later, 'IoMisc' is used as the index to access buffers 'mSmmCpuIoWidth' and 'mSmmCpuIoType'. One can observe which part of the content within those buffers was brought into cache to possibly reveal the value of 'IoMisc'. Hence, this commit adds a AsmLfence() after the check of 'CpuIndex' within function SmmReadSaveState() to prevent the speculative execution. A more detailed explanation of the purpose of commit is under the 'Bounds check bypass mitigation' section of the below link: https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation And the document at: https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf Cc: Michael D Kinney <michael.d.kinney@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Regression-tested-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit 5b02be4d9a234d80c7578fc3a0c789d22ce83f38)
* MdeModulePkg/Variable: [CVE-2017-5753] Fix bounds check bypassHao Wu2018-11-217-0/+98
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194 Speculative execution is used by processor to avoid having to wait for data to arrive from memory, or for previous operations to finish, the processor may speculate as to what will be executed. If the speculation is incorrect, the speculatively executed instructions might leave hints such as which memory locations have been brought into cache. Malicious actors can use the bounds check bypass method (code gadgets with controlled external inputs) to infer data values that have been used in speculative operations to reveal secrets which should not otherwise be accessed. This commit will focus on the SMI handler(s) registered within the Variable\RuntimeDxe driver and insert AsmLfence API to mitigate the bounds check bypass issue. For SMI handler SmmVariableHandler(): Under "case SMM_VARIABLE_FUNCTION_GET_VARIABLE:", 'SmmVariableHeader->NameSize' can be a potential cross boundary access of the 'CommBuffer' (controlled external input) during speculative execution. This cross boundary access is later used as the index to access array 'SmmVariableHeader->Name' by code: "SmmVariableHeader->Name[SmmVariableHeader->NameSize/sizeof (CHAR16) - 1]" One can observe which part of the content within array was brought into cache to possibly reveal the value of 'SmmVariableHeader->NameSize'. Hence, this commit adds a AsmLfence() after the boundary/range checks of 'CommBuffer' to prevent the speculative execution. And there are 2 similar cases under "case SMM_VARIABLE_FUNCTION_SET_VARIABLE:" and "case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET:" as well. This commits also handles them. Also, under "case SMM_VARIABLE_FUNCTION_SET_VARIABLE:", '(UINT8 *)SmmVariableHeader->Name + SmmVariableHeader->NameSize' points to the 'CommBuffer' (with some offset) and then passed as parameter 'Data' to function VariableServiceSetVariable(). Within function VariableServiceSetVariable(), there is a sanity check for EFI_VARIABLE_AUTHENTICATION_2 descriptor for the data pointed by 'Data'. If this check is speculatively bypassed, potential cross-boundary data access for 'Data' is possible to be revealed via the below function calls sequence during speculative execution: AuthVariableLibProcessVariable() ProcessVarWithPk() or ProcessVarWithKek() Within function ProcessVarWithPk() or ProcessVarWithKek(), for the code "PayloadSize = DataSize - AUTHINFO2_SIZE (Data);", 'AUTHINFO2_SIZE (Data)' can be a cross boundary access during speculative execution. Then, 'PayloadSize' is possible to be revealed by the function call sequence: AuthServiceInternalUpdateVariableWithTimeStamp() mAuthVarLibContextIn->UpdateVariable() VariableExLibUpdateVariable() UpdateVariable() CopyMem() Hence, this commit adds a AsmLfence() after the sanity check for EFI_VARIABLE_AUTHENTICATION_2 descriptor upon 'Data' within function VariableServiceSetVariable() to prevent the speculative execution. Also, please note that the change made within function VariableServiceSetVariable() will affect DXE as well. However, since we only focuses on the SMM codes, the commit will introduce a new module internal function called VariableLoadFence() to handle this. This internal function will have 2 implementations (1 for SMM, 1 for DXE). For the SMM implementation, it is a wrapper to call the AsmLfence() API; for the DXE implementation, it is empty. A more detailed explanation of the purpose of commit is under the 'Bounds check bypass mitigation' section of the below link: https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation And the document at: https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Regression-tested-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit e83d841fdc2878959185c4c6cc38a7a1e88377a4)
* MdeModulePkg/SmmLockBox: [CVE-2017-5753] Fix bounds check bypassHao Wu2018-11-211-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194 Speculative execution is used by processor to avoid having to wait for data to arrive from memory, or for previous operations to finish, the processor may speculate as to what will be executed. If the speculation is incorrect, the speculatively executed instructions might leave hints such as which memory locations have been brought into cache. Malicious actors can use the bounds check bypass method (code gadgets with controlled external inputs) to infer data values that have been used in speculative operations to reveal secrets which should not otherwise be accessed. This commit will focus on the SMI handler(s) registered within the SmmLockBox driver and insert AsmLfence API to mitigate the bounds check bypass issue. For SMI handler SmmLockBoxHandler(): Under "case EFI_SMM_LOCK_BOX_COMMAND_SAVE:", the 'CommBuffer' (controlled external inputs) is passed to function SmmLockBoxSave(). 'TempLockBoxParameterSave.Length' can be a potential cross boundary access of the 'CommBuffer' during speculative execution. This cross boundary access is later passed as parameter 'Length' into function SaveLockBox(). Within function SaveLockBox(), the value of 'Length' can be inferred by code: "CopyMem ((VOID *)(UINTN)SmramBuffer, (VOID *)(UINTN)Buffer, Length);". One can observe which part of the content within 'Buffer' was brought into cache to possibly reveal the value of 'Length'. Hence, this commit adds a AsmLfence() after the boundary/range checks of 'CommBuffer' to prevent the speculative execution. And there is a similar case under "case EFI_SMM_LOCK_BOX_COMMAND_UPDATE:" function SmmLockBoxUpdate() as well. This commits also handles it. A more detailed explanation of the purpose of commit is under the 'Bounds check bypass mitigation' section of the below link: https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation And the document at: https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Regression-tested-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit ee65b84e7663d12c1f950a418a0ed63776a80e4f)
* MdeModulePkg/FaultTolerantWrite:[CVE-2017-5753]Fix bounds check bypassHao Wu2018-11-212-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1194 Speculative execution is used by processor to avoid having to wait for data to arrive from memory, or for previous operations to finish, the processor may speculate as to what will be executed. If the speculation is incorrect, the speculatively executed instructions might leave hints such as which memory locations have been brought into cache. Malicious actors can use the bounds check bypass method (code gadgets with controlled external inputs) to infer data values that have been used in speculative operations to reveal secrets which should not otherwise be accessed. This commit will focus on the SMI handler(s) registered within the FaultTolerantWriteDxe driver and insert AsmLfence API to mitigate the bounds check bypass issue. For SMI handler SmmFaultTolerantWriteHandler(): Under "case FTW_FUNCTION_WRITE:", 'SmmFtwWriteHeader->Length' can be a potential cross boundary access of the 'CommBuffer' (controlled external inputs) during speculative execution. This cross boundary access is later passed as parameter 'Length' into function FtwWrite(). Within function FtwWrite(), the value of 'Length' can be inferred by code: "CopyMem (MyBuffer + Offset, Buffer, Length);". One can observe which part of the content within 'Buffer' was brought into cache to possibly reveal the value of 'Length'. Hence, this commit adds a AsmLfence() after the boundary/range checks of 'CommBuffer' to prevent the speculative execution. A more detailed explanation of the purpose of commit is under the 'Bounds check bypass mitigation' section of the below link: https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation And the document at: https://software.intel.com/security-software-guidance/api-app/sites/default/files/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Regression-tested-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit cb54cd24634cfeccadb661f7f65aab3adee05e1c)
* MdePkg/BaseLib: Add new AsmLfence APIHao Wu2018-11-214-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1193 This commit will add a new BaseLib API AsmLfence(). This API will perform a serializing operation on all load-from-memory instructions that were issued prior to the call of this function. Please note that this API is only available on IA-32 and x64. The purpose of adding this API is to mitigate of the [CVE-2017-5753] Bounds Check Bypass issue when untrusted data are being processed within SMM. More details can be referred at the 'Bounds check bypass mitigation' section at the below link: https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Michael D Kinney <michael.d.kinney@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Regression-tested-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit 2ecd829972f8553de83fbf943c5b89863999d7c8)
* UefiCpuPkg: [CVE-2017-5715] Stuff RSB before RSMHao Wu2018-11-215-4/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1093 Return Stack Buffer (RSB) is used to predict the target of RET instructions. When the RSB underflows, some processors may fall back to using branch predictors. This might impact software using the retpoline mitigation strategy on those processors. This commit will add RSB stuffing logic before returning from SMM (the RSM instruction) to avoid interfering with non-SMM usage of the retpoline technique. After the stuffing, RSB entries will contain a trap like: SpecTrap: pause lfence jmp SpecTrap A more detailed explanation of the purpose of commit is under the 'Branch target injection mitigation' section of the below link: https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation This commit introduces a .INC file that contains the RSB logic and it can be included by .ASM files. This file is placed at directory 'UefiCpuPkg/Include/'. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Eric Dong <eric.dong@intel.com>
* IntelFrameworkModulePkg: Fix UEFI and Tiano Decompression logic issueLiming Gao2018-11-141-0/+6
| | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1317 This is a regression issue caused by 684db6da64bc7b5faee4e1174e801c245f563b5c. In Decode() function, once mOutBuf is fully filled, Decode() should return. Current logic misses the checker of mOutBuf after while() loop. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com> (cherry picked from commit ade71c52a49d659b20c0b433fb11ddb4f4f543c4)
* MdePkg BaseUefiDecompressLib: Fix UEFI Decompression logic issueLiming Gao2018-11-141-0/+6
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1317 This is a regression issue caused by 2ec7953d49677142c5f7552e9e3d96fb406ba0c4. In Decode() function, once mOutBuf is fully filled, Decode() should return. Current logic misses the checker of mOutBuf after while() loop. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Liming Gao <liming.gao@intel.com> Cc: Michael Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com> (cherry picked from commit 1c4cecc9fd314de0dce8125b0d4b45967637a401)
* BaseTools: Fix UEFI and Tiano Decompression logic issueLiming Gao2018-11-142-0/+12
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1317 This is a regression issue caused by 041d89bc0f0119df37a5fce1d0f16495ff905089. In Decode() function, once mOutBuf is fully filled, Decode() should return. Current logic misses the checker of mOutBuf after while() loop. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Liming Gao <liming.gao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com> (cherry picked from commit 5e45a1fdcfbf9b2b389122eb97475148594625f8)
* BaseTools: Add more checker in Decompress algorithm to access the valid ↵Liming Gao2018-10-242-4/+48
| | | | | | | | | | | | | | buffer (CVE FIX) Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735 https://bugzilla.tianocore.org/show_bug.cgi?id=686 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com> Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit 041d89bc0f0119df37a5fce1d0f16495ff905089)
* IntelFrameworkModulePkg: Add more checker in UefiTianoDecompressLib (CVE FIX)Liming Gao2018-10-241-2/+14
| | | | | | | | | | | | | Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735 https://bugzilla.tianocore.org/show_bug.cgi?id=686 To make sure the valid buffer be accessed only. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com> Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit 684db6da64bc7b5faee4e1174e801c245f563b5c)
* MdePkg: Add more checker in UefiDecompressLib to access the valid buffer ↵Liming Gao2018-10-241-2/+15
| | | | | | | | | | | | | | only (CVE FIX) Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735 https://bugzilla.tianocore.org/show_bug.cgi?id=686 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com> Signed-off-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com> Acked-by: Laszlo Ersek <lersek@redhat.com> (cherry picked from commit 2ec7953d49677142c5f7552e9e3d96fb406ba0c4)
* MdeModulePkg Variable: Fix Timestamp zeroing issue on APPEND_WRITEStar Zeng2018-10-171-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=415 When SetVariable() to a time based auth variable with APPEND_WRITE attribute, and if the EFI_VARIABLE_AUTHENTICATION_2.TimeStamp in the input Data is earlier than current value, it will cause timestamp zeroing. This issue may bring time based auth variable downgrade problem. For example: A vendor released three certs at 2014, 2015, and 2016, and system integrated the 2016 cert. User can SetVariable() with 2015 cert and APPEND_WRITE attribute to cause timestamp zeroing first, then SetVariable() with 2014 cert to downgrade the cert. This patch fixes this issue. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> (cherry picked from commit b7dc8888f31402f410c53242839271ba3b94b619)
* SecurityPkg OpalPasswordSupportLib: Add check to avoid potential buffer ↵Eric Dong2018-08-014-24/+42
| | | | | | | | | | | | | | | | | | overflow. Current code not check the CommunicationBuffer size before use it. Attacker can read beyond the end of the (untrusted) commbuffer into controlled memory. Attacker can get access outside of valid SMM memory regions. This patch add check before use it. bugz: https://bugzilla.tianocore.org/show_bug.cgi?id=198 Cc: Yao Jiewen <jiewen.yao@intel.com> Cc: Wu Hao <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Eric Dong <eric.dong@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com> (cherry picked from commit 87acb6e298e718250dd8b741b6888a3a54c7cb5a)
* MdeModulePkg/DxeCore: UEFI mem attrib table update.Jiewen Yao2018-07-265-41/+158
| | | | | | | | | | | | | | | | | | | | | | 1) MdeModulePkg/DxeCore: Install UEFI mem attrib table at EndOfDxe. So that the SMM can consume it to set page protection for the UEFI runtime page with EFI_MEMORY_RO attribute. 2) MdeModulePkg/DxeCore: Not update RtCode in MemAttrTable after EndOfDxe We want to provide precise info in MemAttribTable to both OS and SMM, and SMM only gets the info at EndOfDxe. So we do not update RtCode entry in EndOfDxe. The impact is that if 3rd part OPROM is runtime, it cannot be executed at UEFI runtime phase. Currently, we do not see compatibility issue, because the only runtime OPROM we found before in UNDI, and UEFI OS will not use UNDI interface in OS. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
* MdePkg/SmmMemLib: Check EFI_MEMORY_RO in UEFI mem attrib table.Jiewen Yao2018-07-262-4/+60
| | | | | | | | It treats the UEFI runtime page with EFI_MEMORY_RO attribute as invalid SMM communication buffer. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
* MdePkg/SmmMemLib: Check for untested memory in GCDJiewen Yao2018-07-262-7/+93
| | | | | | | | It treats GCD untested memory as invalid SMM communication buffer. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg:Tcg2Smm: Update TcgNvs info after memory is allocatedZhang, Chao B2018-05-251-7/+12
| | | | | | | | | | | | | Update package format info in _PRS to TcgNvs after memory is allocated. Change-Id: Icfadb350e60d3ed2df332e92c257ce13309c0018 Contributed-under: TianoCore Contribution Agreement 1.1 Cc: Yao Jiewen <jiewen.yao@intel.com> Cc: Long Qin <qin.long@intel.com> Signed-off-by: Zhang, Chao B <chao.b.zhang@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> (cherry picked from commit 1ea08a3dcdd61c7481ec78ad8b8037ee6ca45402) (cherry picked from commit fb8254478f7259d22d8433f6729307e001b81bdd)
* SecurityPkg Tpm2CommandLib: Fix TPM2.0 response memory overflowZhang, Chao B2018-04-097-9/+111
| | | | | | | | | | | | | | TPM2.0 command lib always assumes TPM device and transmission channel can respond correctly. But it is not true when communication channel is exploited and wrong data is spoofed. Add more logic to prohibit memory overflow attack. Cc: Long Qin <qin.long@intel.com> Cc: Yao Jiewen <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com> (cherry picked from commit dd577319e83d13a7ab46ffdccb6635281d2ca9e5)
* SecurityPkg: Tcg2Smm: Refine type cast in pointer abstractionZhang, Chao B2018-03-221-1/+1
| | | | | | | | | | | | | | | Pointer subtraction is not performed by pointers to elements of the same array object. Such behavior is undefined by C11 standard and might lead to potential issues, Refine pointer subtraction by first casting each pointer to UINTN. Cc: Hao Wu <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Hao Wu <hao.a.wu@intel.com> (cherry picked from commit 28fd7b090d1b416f1e94e52abd08bf16fd404649) (cherry picked from commit 1c65ddbf242034a96cdc1fa039b0f1f5d5797b60) (cherry picked from commit 007386ef63defc5589c1bd5aa13d214c40ea6179)
* SecurityPkg:Tcg2Smm: Fix compile issueZhang, Chao B2018-03-221-3/+4
| | | | | | | | | | | | | Update Tcg2Smm _PRS patching logic to fix compile issue Cc: Liming Gao <liming.gao@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> (cherry picked from commit 449083a3f897fd2e93355b8e0774bd3f63211b17) (cherry picked from commit abb0427276d323035832b869e53473d2412245f3) (cherry picked from commit d207ef6f5a856d04ee175baf44e7e94a024d60a3)
* SecurityPkg: Add UNI string for 2 PCDsZhang, Chao B2018-03-221-1/+10
| | | | | | | | | | Add prompt & help string for PcdTpm2CurrentIrqNum, PcdTpm2PossibleIrqNumBuf Cc: Dandan Bi <dandan.bi@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> (cherry picked from commit ce5894551315ede5d01b04e1ecc1725cb39c91a0) (cherry picked from commit db9d1fa56cc039bd466c35ef9eafc5a0f7a1c369)
* SecurityPkg: Disable TPM interrupt in DECZhang, Chao B2018-03-221-2/+2
| | | | | | | | | | | | | | Disable TPM interrupt support in DEC by default to keep compatibility Cc: Yao Jiewen <jiewen.yao@intel.com> Cc: Long Qin <qin.long@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> (cherry picked from commit 5552ac423193a0236134112457d1ac52d6d9896b) (cherry picked from commit 14553a2e5d9b3255a94fa0a359d96ebe4e82540a) (cherry picked from commit e890056bb8217ddc651253c30a5a99430bb45120)
* SecurityPkg: Tcg2Smm: Enable TPM2.0 interrupt supportZhang, Chao B2018-03-225-21/+388
| | | | | | | | | | | | | | 1. Expose _CRS, _SRS, _PRS control method to support TPM interrupt 2. Provide 2 PCDs to configure _CRS and _PRS returned data Cc: Yao Jiewen <jiewen.yao@intel.com> Cc: Ronald Aigner <Ronald.Aigner@microsoft.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Yao Jiewen <jiewen.yao@intel.com> (cherry picked from commit c4122dcaadb964a3e5d2fe106939bca4f1c261e8) (cherry picked from commit 1ed328a0d7432f3144a82b3906b62084228577f8) (cherry picked from commit 4445bb29b3876befaad807c42ed2c3713333fa4d)
* SecurityPkg:Tcg2Smm: Update Interrupt resource nameZhang, Chao B2018-03-221-7/+7
| | | | | | | | | | | | | Update TPM interrupt resource descriptor name for better compatibility to old ASL compiler. Cc: Long Qin <qin.long@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> (cherry picked from commit 73d777329f84b5f4acdbc4369b56c0670e873cff) (cherry picked from commit 1eff644477b0a2bf46cfde4801aa7bc16a11043e)
* SecurityPkg:Tcg2Smm: Add MSFT copyrightZhang, Chao B2018-03-221-0/+1
| | | | | | | | | | | | Add MSFT copyright for TPM SIRQ feature. Cc: Long Qin <qin.long@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> (cherry picked from commit af9743ef44f282a66c02998ac39e98d9826d16c5) (cherry picked from commit 3d41e7b48d5c43159f567124bd6cef2122f0daa8)
* SecurityPkg:Tcg2Smm:Enabling TPM SIRQ interrupt supportZhang, Chao B2018-03-221-7/+105
| | | | | | | | | | | | | | | | | 1. Report TPM SIRQ interrupt resource through _CRS 2. Expose _SRS to update interrupt resource & FIFO/TIS interrupt related registers defined in TCG PC Client Platform TPM Profile (PTP) Specification spec https://trustedcomputinggroup.org/wp-content/uploads/PC-Client-Specific-Platform-TPM-Profile-for-TPM-2-0-v43-150126.pdf Note: IHV/OEM need to carefully verify this feature with OS TPM driver to make sure there is no impact to system/HW Cc: Long Qin <qin.long@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Long Qin <qin.long@intel.com> (cherry picked from commit edf7647bae9e7ae212abd8e3922592d49721a8ad) (cherry picked from commit c3abd1c7a571d6f07b60524c6268bc490fd4bba8)
* Nt32Pkg/SnpNt32Dxe: Fix hang issue when multiple network interfaces existedJiaxin Wu2017-06-272-40/+41
| | | | | | | | | | | | | | | | | Currently all the network interfaces share the one recycled transmit buffer array, which is used to store the recycled buffer address. However, those recycled buffers are allocated by the different MNP interface if the multiple network interfaces existed. Then, SNP GetStatus may return one recycled transmit buffer address to the another MNP interface, which may result in the MNP driver hang after 'reconnect -r' operation. Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Ruiyu Ni <ruiyu.ni@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> (cherry picked from commit d547b32dccbef8bd4fedda648db270ad4cbf3857)
* Nt32Pkg: Fix SnpNt32 GetStatus bugZhang Lubo2017-06-272-3/+61
| | | | | | | | | | | | | | | According to UEFI spec, the Snp.GetStatus should return the recycled transmit buffer address, while the NT32 SNP always return value 1 for the Txbuffer. Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Ye Ting <ting.ye@intel.com> Cc: Wu Jiaxin <jiaxin.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Zhang Lubo <lubo.zhang@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com> (cherry picked from commit a2cc5fea44b5b5a28dcf6448eafe61aa5ebb42c7)
* NetworkPkg/IpSecDxe: Add check to avoid possible divide by zeroHao Wu2017-06-271-1/+7
| | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> (cherry picked from commit ce8e582c06ef3d82b1df93a7de289ef7d9905c4a)
* MdeModulePkg/Ip4Dxe: Add Ip/Netmask pair check for Ip4Config2Jiaxin Wu2017-05-185-66/+99
| | | | | | | | | | | | | | | | | | | | | | | | v2: * Add the check in Ip4Config2SetDefaultIf to avoid the DHCP configuration case. Ip4config2 doesn't check the validity of Ip/Netmask pair, which leads to the invalid combination of Ip and Netmask setting. This patch is to resolve the issue. Cc: Hegde Nagaraj P <nagaraj-p.hegde@hpe.com> Cc: Subramanian Sriram <sriram-s@hpe.com> Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Sriram Subramanian <sriram-s@hpe.com> Reviewed-by: Hegde Nagaraj P <nagaraj-p.hegde@hpe.com> (cherry picked from commit f1222593f2a8944ab8f61f3864b6ae80633faecf) Conflicts: MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Config2Impl.c MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Impl.c
* MdeModulePkg/Network: Fix potential ASSERT if NetIp4IsUnicast is calledJiaxin Wu2017-05-185-12/+16
| | | | | | | | | | | | | | Cc: Hegde Nagaraj P <nagaraj-p.hegde@hpe.com> Cc: Subramanian Sriram <sriram-s@hpe.com> Cc: Zhang Lubo <lubo.zhang@intel.com> Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Hegde Nagaraj P <nagaraj-p.hegde@hpe.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Sriram Subramanian <sriram-s@hpe.com> (cherry picked from commit d0e76ac5ce07eb116f8cbea90b7f373d0c127a78)
* MdeModulePkg: Check for NULL pointer before dereference it.Fu Siyuan2017-05-181-4/+8
| | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> (cherry picked from commit e86f363564e79dc719bbeed8ce87271b2972f55d)
* NetworkPkg: Fix potential ASSERT if NetIp4IsUnicast is calledJiaxin Wu2017-05-183-6/+8
| | | | | | | | | | | | | | Cc: Hegde Nagaraj P <nagaraj-p.hegde@hpe.com> Cc: Subramanian Sriram <sriram-s@hpe.com> Cc: Zhang Lubo <lubo.zhang@intel.com> Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Hegde Nagaraj P <nagaraj-p.hegde@hpe.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Sriram Subramanian <sriram-s@hpe.com> (cherry picked from commit ba0252808b2d0a0362d6bcd9ddef6cd3d2e3bca3)
* NetworkPkg: Check for NULL pointer before dereference it.Fu Siyuan2017-05-181-3/+7
| | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> (cherry picked from commit b3400560603bcfaadc08e82a846933446b5afed3)
* MdeModulePkg: Addressing TCP Window Retraction when window scale factor is used.Fu Siyuan2017-05-173-10/+43
| | | | | | | | | | | | | | The RFC1323 which defines the TCP window scale option has been obsoleted by RFC7323. This patch is to follow the RFC7323 to address the TCP window retraction problem when a non-zero scale factor is used. The changes has been test in high packet loss rate network by using HTTP boot and iSCSI file read/write. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> (cherry picked from commit ca12a0c83b7b889fc807cb2dd47356f0fd1253d6)
* NetworkPkg: Addressing TCP Window Retraction when window scale factor is used.Fu Siyuan2017-05-173-6/+36
| | | | | | | | | | | | | | The RFC1323 which defines the TCP window scale option has been obsoleted by RFC7323. This patch is to follow the RFC7323 to address the TCP window retraction problem when a non-zero scale factor is used. The changes has been test in high packet loss rate network by using HTTP boot and iSCSI file read/write. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> (cherry picked from commit 3696ceaecb03fc8d66988649506f5f22a6526d1e)
* MdeModulePkg: Add wnd scale check before shrinking window.Fu Siyuan2017-05-171-3/+24
| | | | | | | | | | | | Moving Right window edge to the left on sender side without additional check can lead to the TCP deadlock, when receiver ACKs proper segment, while sender discards it for future ACK. To prevent this add check if usable window (or shrink amount in this case) is bigger then receiver's window scale factor. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Andrey Tepin <atepin@kraftway.ru> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> (cherry picked from commit 207b3d2b0b7db33bd65e1943a66d7ee9b7132697)
* NetworkPkg: Add wnd scale check before shrinking window.Fu Siyuan2017-05-171-3/+23
| | | | | | | | | | | | Moving Right window edge to the left on sender side without additional check can lead to the TCP deadlock, when receiver ACKs proper segment, while sender discards it for future ACK. To prevent this add check if usable window (or shrink amount in this case) is bigger then receiver's window scale factor. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Andrey Tepin <atepin@kraftway.ru> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> (cherry picked from commit 2d5afbdad1bbe2663917c0b3ad06753bbf128c6c)
* MdeModulePkg: Discard received broadcast message in DxeIpIoLib.Fu Siyuan2017-05-171-0/+6
| | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> (cherry picked from commit dd29d8b3565ba8ae2e71c097a95b22af5d1d90a4)
* MdeModulePkg/Mtftp4Dxe: Add invalid ServerIp check during MTFTP configurationJiaxin Wu2017-05-171-1/+5
| | | | | | | | | | Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> (cherry picked from commit 17b25f520302f813a50f7876edc2e8fc901e7a7c)
* NetworkPkg: Update IP4 stack drivers for classless address unicast check.Fu Siyuan2017-05-174-21/+45
| | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> (cherry picked from commit 6c12fe63f989b1a3aff9f44c22b2833fa78cfcab)
* MdeModulePkg: Update IP4 stack drivers for classless address unicast check.Fu Siyuan2017-05-1714-79/+84
| | | | | | | | Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> (cherry picked from commit 01b5ac880f00cf89833e6fc80666bccc9779dea7)
* MdeModulePkg: Update NetLib interface to support classless addressing.Fu Siyuan2017-05-172-23/+26
| | | | | | | | | | | | | | | | | | | | The classful addressing (IP class A/B/C) has been deprecated according to RFC4632. This patch updates the NetLib NetGetIpClass() and NetIp4IsUnicast() accordingly. NetGetIpClass() The function is kept for compatibility, while the caller of this function could only check the returned value against with IP4_ADDR_CLASSD (multicast) or IP4_ADDR_CLASSE (reserved) now. The function has been updated to note this. NetIp4IsUnicast() The NetMask becomes a required parameter to check the unicast address. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan <siyuan.fu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> (cherry picked from commit 3289dcba45e48af5c4fd329f57c49cc8e5830ed8)
* MdeModulePkg: Support classless IP for DHCPv4 TransmitReceive()Jiaxin Wu2017-05-171-8/+20
| | | | | | | | | | | | | | | | The IP address should not be treated as classful one if DHCP options contain a classless IP with its true subnet mask. Otherwise, DHCPv4 TransmitReceive() will failed. This real subnet mask will be parsed and recorded in DhcpSb->Netmask. So, we need check it before get the IP's corresponding subnet mask. Cc: Santhapur Naveen <naveens@amiindia.co.in> Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com> (cherry picked from commit 8c5f78a2cc15199e3f77ae4b156023af366fd6c7)
* MdeModulePkg/HiiDatabaseDxe: Fix a variable is uninitialized.Cinnamon Shia2017-05-161-0/+2
| | | | | | | | | | | | | The StringSize variable in the FindStringBlock function is a IN OUT parameter of the GetUnicodeStringTextOrSize function. Thought the GetUnicodeStringTextOrSize function changes the value of the StringSize variable, it is better to initialize the StringSize variable before passing it to the GetUnicodeStringTextOrSize function. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Cinnamon Shia <cinnamon.shia@hpe.com> Reviewed-by: Eric Dong <eric.dong@intel.com> (cherry picked from commit f5e6aa8e176c3f1dc557d85749ef797b8d482b56)
* IntelFrameworkPkg/UefiLib: Avoid mis-calculate of graphic console sizeHao Wu2017-05-161-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | The commit adds check in function InternalPrintGraphic() to ensure that the expression: Blt->Width * Blt->Height * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) will not overflow in the UINTN range. The commit also adds an explicit UINT32 type cast for 'Blt->Width' to avoid possible overflow in the int range for: Blt->Width * Blt->Height Since both Blt->Width and Blt->Height are of type UINT16. They will be promoted to int (signed) first, and then perform the multiplication operation. If the result of multiplication between Blt->Width and Blt->Height exceeds the range of type int, a potential incorrect size will be passed into function AllocateZeroPool(). Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> (cherry picked from commit 9c0e4db3db8d102812ca57f6225290c7ba079ad8)
* MdePkg/UefiLib: Avoid mis-calculate of graphic console sizeHao Wu2017-05-161-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | The commit adds check in function InternalPrintGraphic() to ensure that the expression: Blt->Width * Blt->Height * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) will not overflow in the UINTN range. The commit also adds an explicit UINT32 type cast for 'Blt->Width' to avoid possible overflow in the int range for: Blt->Width * Blt->Height Since both Blt->Width and Blt->Height are of type UINT16. They will be promoted to int (signed) first, and then perform the multiplication operation. If the result of multiplication between Blt->Width and Blt->Height exceeds the range of type int, a potential incorrect size will be passed into function AllocateZeroPool(). Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> (cherry picked from commit 458cd568b64a0e4159f85a31809e55657db23792)
generated by cgit (git 2.34.1) at 2025-02-22 22:55:45 +0000