diff options
| author | Ivan Gorinov <ivan.gorinov@intel.com> | 2018-05-25 10:45:09 -0700 |
|---|---|---|
| committer | Alexander Graf <agraf@suse.de> | 2018-06-03 15:27:21 +0200 |
| commit | fe5bc23f43341d19528b15aaf6e09f56975e1316 (patch) | |
| tree | 3bff70d6926cd7081902ff8eb54d77720fbe4be3 /lib | |
| parent | 7f474ef6cc3565bb3538b7004a50fd79280ae105 (diff) | |
| download | u-boot-fe5bc23f43341d19528b15aaf6e09f56975e1316.zip u-boot-fe5bc23f43341d19528b15aaf6e09f56975e1316.tar.gz u-boot-fe5bc23f43341d19528b15aaf6e09f56975e1316.tar.bz2 | |
efi_selftest: check for buffer overflow in efi_get_variable
Allocate a buffer on the stack instead of an array of uninitialized
pointers; check if GetVariable writes past the end of the buffer.
Signed-off-by: Ivan Gorinov <ivan.gorinov@intel.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/efi_selftest/efi_selftest_variables.c | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/lib/efi_selftest/efi_selftest_variables.c b/lib/efi_selftest/efi_selftest_variables.c index f5e8eb6..146378f 100644 --- a/lib/efi_selftest/efi_selftest_variables.c +++ b/lib/efi_selftest/efi_selftest_variables.c @@ -49,7 +49,7 @@ static int execute(void) u32 attr; u8 v[16] = {0x5d, 0xd1, 0x5e, 0x51, 0x5a, 0x05, 0xc7, 0x0c, 0x35, 0x4a, 0xae, 0x87, 0xa5, 0xdf, 0x0f, 0x65,}; - u8 *data[EFI_ST_MAX_DATA_SIZE]; + u8 data[EFI_ST_MAX_DATA_SIZE]; u16 varname[EFI_ST_MAX_VARNAME_SIZE]; int flag; efi_guid_t guid; @@ -72,6 +72,22 @@ static int execute(void) efi_st_error("SetVariable failed\n"); return EFI_ST_FAILURE; } + data[3] = 0xff; + len = 3; + ret = runtime->get_variable(L"efi_st_var0", &guid_vendor0, + &attr, &len, data); + if (ret != EFI_SUCCESS) { + efi_st_error("GetVariable failed\n"); + return EFI_ST_FAILURE; + } + if (efi_st_memcmp(data, v + 4, 3)) { + efi_st_error("GetVariable returned wrong value\n"); + return EFI_ST_FAILURE; + } + if (data[3] != 0xff) { + efi_st_error("GetVariable wrote past the end of the buffer\n"); + return EFI_ST_FAILURE; + } /* Set variable 1 */ ret = runtime->set_variable(L"efi_st_var1", &guid_vendor1, EFI_VARIABLE_BOOTSERVICE_ACCESS, |