]> git.proxmox.com Git - mirror_edk2.git/commit
MdeModulePkg/UdfDxe: Memory free/use after free in ResolveSymlink()
authorHao Wu <hao.a.wu@intel.com>
Tue, 30 Oct 2018 01:17:04 +0000 (09:17 +0800)
committerHao Wu <hao.a.wu@intel.com>
Wed, 31 Oct 2018 00:57:04 +0000 (08:57 +0800)
commit27b9cb33e7437f6aef184c6b2982d004d279cc04
tree0190735399495bad095c9ddca71dbd247fab5d91
parentbfb8c64cbf6a4604b1a69de8e274cce7f0a678dc
MdeModulePkg/UdfDxe: Memory free/use after free in ResolveSymlink()

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1279

For function ResolveSymlink(), the below codes:

    if (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent,
                    sizeof (UDF_FILE_INFO)) != 0) {
      CleanupFileInformation (&PreviousFile);
    }

    CopyMem ((VOID *)&PreviousFile, (VOID *)File, sizeof (UDF_FILE_INFO));

If the contents in 'PreviousFile' and 'File' are the same, call to
"CleanupFileInformation (&PreviousFile);" will free the buffers in 'File'
as well. This will lead to potential memory double free/use after free
issues.

This commit will add additional check to address the above issue.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Paulo Alcantara <palcantara@suse.de>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>
MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c