summaryrefslogtreecommitdiffstats
path: root/CryptoPkg
diff options
context:
space:
mode:
authorLong Qin <qin.long@intel.com>2018-10-24 21:16:42 +0800
committerLong Qin <qin.long@intel.com>2018-10-31 11:07:53 +0800
commit269f3b51803685eb3f4f4cd4415dc833d375efba (patch)
tree887217b1784fdccad65d02cd3173bd2cb96126cf /CryptoPkg
parentbeabfd5800515e0a51fc2461671514adc0cef584 (diff)
downloadedk2-269f3b51803685eb3f4f4cd4415dc833d375efba.tar.gz
edk2-269f3b51803685eb3f4f4cd4415dc833d375efba.tar.bz2
edk2-269f3b51803685eb3f4f4cd4415dc833d375efba.zip
CryptoPkg/BaseCryptLib: Fix potential integer overflow issue.
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1275 The LookupFreeMemRegion() in RuntimeMemAllocate.c is used to look-up free memory region for runtime resource allocation, which was designed to support runtime authenticated variable service. The ReqPages in this function is the required pages to be allocated, which depends on the malloc() call in internal OpenSSL routines. The direct offset subtractions on ReqPages may bring possible integer overflow issue. This patch is to add the extra parameter checks to remove this possible overflow risk. Cc: Ye Ting <ting.ye@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Long Qin <qin.long@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com>
Diffstat (limited to 'CryptoPkg')
-rw-r--r--CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c b/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c
index 463f2bf855..92bb9ddccd 100644
--- a/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c
+++ b/CryptoPkg/Library/BaseCryptLib/SysCall/RuntimeMemAllocation.c
@@ -2,7 +2,7 @@
Light-weight Memory Management Routines for OpenSSL-based Crypto
Library at Runtime Phase.
-Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@@ -141,6 +141,12 @@ LookupFreeMemRegion (
StartPageIndex = RT_SIZE_TO_PAGES (mRTPageTable->LastEmptyPageOffset);
ReqPages = RT_SIZE_TO_PAGES (AllocationSize);
+ if (ReqPages > mRTPageTable->PageCount) {
+ //
+ // No enough region for object allocation.
+ //
+ return (UINTN)(-1);
+ }
//
// Look up the free memory region with in current memory map table.
@@ -176,6 +182,12 @@ LookupFreeMemRegion (
// Look up the free memory region from the beginning of the memory table
// until the StartCursorOffset
//
+ if (ReqPages > StartPageIndex) {
+ //
+ // No enough region for object allocation.
+ //
+ return (UINTN)(-1);
+ }
for (Index = 0; Index < (StartPageIndex - ReqPages); ) {
//
// Check Consecutive ReqPages Pages.