From 30da4837584643c637eea751dbb01e0718fa764d Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Mon, 21 Oct 2024 14:45:37 -0400 Subject: [PATCH] MdePkg: Fix overflow issue in BasePeCoffLib RH-Author: Jon Maloy RH-MergeRequest: 96: MdePkg: Fix overflow issue in BasePeCoffLib RH-Jira: RHEL-60830 RH-Acked-by: Oliver Steffen RH-Commit: [1/1] 5406406ac2711215ec2bd3d9c1a2e6bb268dda38 (jmaloy/jons_fork) JIRA: https://issues.redhat.com/browse/RHEL-60830 CVE: CVE-2024-38796 Upstream: Merged commit c95233b8525ca6828921affd1496146cff262e65 Author: Doug Flick Date: Fri Sep 27 12:08:55 2024 -0700 MdePkg: Fix overflow issue in BasePeCoffLib The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is also a UINT32 value. The current code does not check for overflow when adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a check to ensure that the addition does not overflow. Signed-off-by: Doug Flick Authored-by: sriraamx gobichettipalayam Signed-off-by: Jon Maloy --- MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c index 1102833b94..6b1ccc7217 100644 --- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c +++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c @@ -991,13 +991,14 @@ PeCoffLoaderRelocateImage ( RelocDir = &Hdr.Te->DataDirectory[0]; } - if ((RelocDir != NULL) && (RelocDir->Size > 0)) { - RelocBase = (EFI_IMAGE_BASE_RELOCATION *) PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset); - RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *) PeCoffLoaderImageAddress (ImageContext, - RelocDir->VirtualAddress + RelocDir->Size - 1, - TeStrippedOffset - ); - if (RelocBase == NULL || RelocBaseEnd == NULL || (UINTN) RelocBaseEnd < (UINTN) RelocBase) { + if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) { + RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset); + RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress ( + ImageContext, + RelocDir->VirtualAddress + RelocDir->Size - 1, + TeStrippedOffset + ); + if ((RelocBase == NULL) || (RelocBaseEnd == NULL) || ((UINTN)RelocBaseEnd < (UINTN)RelocBase)) { ImageContext->ImageError = IMAGE_ERROR_FAILED_RELOCATION; return RETURN_LOAD_ERROR; } -- 2.45.2