]> git.proxmox.com Git - mirror_edk2.git/commit
CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553)
authorLaszlo Ersek <lersek@redhat.com>
Thu, 24 Oct 2019 14:44:08 +0000 (16:44 +0200)
committerLaszlo Ersek <lersek@redhat.com>
Sat, 2 Nov 2019 11:07:25 +0000 (12:07 +0100)
commiteb520d94dba7369d1886cd5522d5a2c36fb02209
treefc9fd0b12be0d626ca4951ae8d4ce380a7a9c597
parent2ca74e1a175232cc201798e27437700adc7fb07e
CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553)

According to the ISO C standard, strchr() is a function. We #define it as
a macro. Unfortunately, our macro evaluates the first argument ("str")
twice. If the expression passed for "str" has side effects, the behavior
may be undefined.

In a later patch in this series, we're going to resurrect "inet_pton.c"
(originally from the StdLib package), which calls strchr() just like that:

  strchr((xdigits = xdigits_l), ch)
  strchr((xdigits = xdigits_u), ch)

To enable this kind of function call, turn strchr() into a function.

Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960
CVE: CVE-2019-14553
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
CryptoPkg/Library/Include/CrtLibSupport.h