From dea2c718df8b58f5147c7674797bf65df649c53e Mon Sep 17 00:00:00 2001 From: Laszlo Ersek Date: Thu, 19 Nov 2020 12:50:34 +0100 Subject: [PATCH] MdeModulePkg/LzmaCustomDecompressLib: catch 4GB+ uncompressed buffer sizes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Laszlo Ersek (lersek) RH-MergeRequest: 1: prevent integer overflow / heap corruption in LZMA decompression [rhel-8.4.0.z] RH-Commit: [1/1] a8ec492d7ebb6ae3c51513f501f72d5418b71f17 RH-Bugzilla: 1952953 RH-Acked-by: Miroslav Rezanina RH-Acked-by: Philippe Mathieu-Daudé The LzmaUefiDecompressGetInfo() function [MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c] currently silently truncates the UINT64 "DecodedSize" property of the compressed blob to the UINT32 "DestinationSize" output parameter. If "DecodedSize" is 0x1_0000_0100, for example, then the subsequent memory allocation (for decompression) will likely succeed (allocating 0x100 bytes only), but then the LzmaUefiDecompress() function (which re-fetches the uncompressed buffer size from the same LZMA header into a "SizeT" variable) will overwrite the buffer. Catch (DecodedSize > MAX_UINT32) in LzmaUefiDecompressGetInfo() at once. This should not be a practical limitation. (The issue cannot be fixed for 32-bit systems without spec modifications anyway, given that the "OutputSize" output parameter of EFI_GUIDED_SECTION_EXTRACTION_PROTOCOL.ExtractSection() has type UINTN, not UINT64.) Cc: Dandan Bi Cc: Hao A Wu Cc: Jian J Wang Cc: Liming Gao Cc: Philippe Mathieu-Daud Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1816 Signed-off-by: Laszlo Ersek Reviewed-by: Liming Gao Reviewed-by: Philippe Mathieu-Daud Message-Id: <20201119115034.12897-2-lersek@redhat.com> (cherry picked from commit e7bd0dd26db7e56aa8ca70132d6ea916ee6f3db0) --- .../Library/LzmaCustomDecompressLib/LzmaDecompress.c | 7 +++++++ .../LzmaCustomDecompressLib/LzmaDecompressLibInternal.h | 5 +++++ 2 files changed, 12 insertions(+) diff --git a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c index c58912eb6a..8f7c242dca 100644 --- a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c +++ b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c @@ -127,6 +127,10 @@ GetDecodedSizeOfBuf( in DestinationSize and the size of the scratch buffer was returned in ScratchSize. + @retval RETURN_UNSUPPORTED DestinationSize cannot be output because the + uncompressed buffer size (in bytes) does not fit + in a UINT32. Output parameters have not been + modified. **/ RETURN_STATUS EFIAPI @@ -142,6 +146,9 @@ LzmaUefiDecompressGetInfo ( ASSERT(SourceSize >= LZMA_HEADER_SIZE); DecodedSize = GetDecodedSizeOfBuf((UINT8*)Source); + if (DecodedSize > MAX_UINT32) { + return RETURN_UNSUPPORTED; + } *DestinationSize = (UINT32)DecodedSize; *ScratchSize = SCRATCH_BUFFER_REQUEST_SIZE; diff --git a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h index 26f110ba2a..fbafd5f100 100644 --- a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h +++ b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h @@ -9,6 +9,7 @@ #ifndef __LZMADECOMPRESSLIB_INTERNAL_H__ #define __LZMADECOMPRESSLIB_INTERNAL_H__ +#include #include #include #include @@ -45,6 +46,10 @@ in DestinationSize and the size of the scratch buffer was returned in ScratchSize. + @retval RETURN_UNSUPPORTED DestinationSize cannot be output because the + uncompressed buffer size (in bytes) does not fit + in a UINT32. Output parameters have not been + modified. **/ RETURN_STATUS EFIAPI -- 2.27.0