SecurityPkg/TPM: measure UEFI images without associated device paths again

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2652

DxeTpm2MeasureBootHandler() and DxeTpmMeasureBootHandler() functions may
receive a FileBuffer argument that is not associated with any particular
device path (e.g., because the UEFI image has not been loaded from any
particular device path).
Therefore rejecting (File==NULL) at the top of the function is invalid.

Fixes: 4b026f0d5af36faf3a3629a3ad49c51b5b3be12f

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Signed-off-by: Guomin Jiang <guomin.jiang@intel.com>

Reviewed-by: Jian J Wang <jian.j.wang@intel.com>

1 files changed, 10 insertions, 10 deletions

diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
index f0e95e5ec0..92eac71580 100644
--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
@@ -384,8 +384,6 @@ Finish:
   and other exception operations.  The File parameter allows for possible logging

   within the SAP of the driver.

 

-  If File is NULL, then EFI_ACCESS_DENIED is returned.

-

   If the file specified by File with an authentication status specified by

   AuthenticationStatus is safe for the DXE Core to use, then EFI_SUCCESS is returned.

 

@@ -398,6 +396,8 @@ Finish:
   might be possible to use it at a future time, then EFI_SECURITY_VIOLATION is

   returned.

 

+  If check image specified by FileBuffer and File is NULL meanwhile, return EFI_ACCESS_DENIED.

+

   @param[in]      AuthenticationStatus  This is the authentication status returned

                                         from the securitymeasurement services for the

                                         input file.

@@ -416,7 +416,7 @@ EFI_STATUS
 EFIAPI

 DxeTpm2MeasureBootHandler (

   IN  UINT32                           AuthenticationStatus,

-  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File,

+  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File, OPTIONAL

   IN  VOID                             *FileBuffer,

   IN  UINTN                            FileSize,

   IN  BOOLEAN                          BootPolicy

@@ -435,13 +435,6 @@ DxeTpm2MeasureBootHandler (
   EFI_PHYSICAL_ADDRESS                FvAddress;

   UINT32                              Index;

 

-  //

-  // Check for invalid parameters.

-  //

-  if (File == NULL) {

-    return EFI_ACCESS_DENIED;

-  }

-

   Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol);

   if (EFI_ERROR (Status)) {

     //

@@ -616,6 +609,13 @@ DxeTpm2MeasureBootHandler (
   Status = PeCoffLoaderGetImageInfo (&ImageContext);

   if (EFI_ERROR (Status)) {

     //

+    // Check for invalid parameters.

+    //

+    if (File == NULL) {

+      Status = EFI_ACCESS_DENIED;

+    }

+

+    //

     // The information can't be got from the invalid PeImage

     //

     goto Finish;