BaseTools: Add more checker in Decompress algorithm to access the valid buffer (CVE...

Fix CVE-2017-5731,CVE-2017-5732,CVE-2017-5733,CVE-2017-5734,CVE-2017-5735
https://bugzilla.tianocore.org/show_bug.cgi?id=686

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Holtsclaw Brent <brent.holtsclaw@intel.com>
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>

diff --git a/BaseTools/Source/C/Common/Decompress.c b/BaseTools/Source/C/Common/Decompress.c
index 9906888933a0183e8d232de580c16839043618a9..71313b11797d268e617be084d37a961fe3705244 100644 (file)
--- a/BaseTools/Source/C/Common/Decompress.c
+++ b/BaseTools/Source/C/Common/Decompress.c
@@ -194,12 +194,16 @@ Returns:
   UINT16  Avail;\r
   UINT16  NextCode;\r
   UINT16  Mask;\r
+  UINT16  MaxTableLength;\r
 \r
   for (Index = 1; Index <= 16; Index++) {\r
     Count[Index] = 0;\r
   }\r
 \r
   for (Index = 0; Index < NumOfChar; Index++) {\r
+    if (BitLen[Index] > 16) {\r
+      return (UINT16) BAD_TABLE;\r
+    }\r
     Count[BitLen[Index]]++;\r
   }\r
 \r
@@ -237,6 +241,7 @@ Returns:
 \r
   Avail = NumOfChar;\r
   Mask  = (UINT16) (1U << (15 - TableBits));\r
+  MaxTableLength = (UINT16) (1U << TableBits);\r
 \r
   for (Char = 0; Char < NumOfChar; Char++) {\r
 \r
@@ -250,6 +255,9 @@ Returns:
     if (Len <= TableBits) {\r
 \r
       for (Index = Start[Len]; Index < NextCode; Index++) {\r
+        if (Index >= MaxTableLength) {\r
+          return (UINT16) BAD_TABLE;\r
+        }\r
         Table[Index] = Char;\r
       }\r
 \r
@@ -643,10 +651,14 @@ Returns: (VOID)
 \r
       BytesRemain--;\r
       while ((INT16) (BytesRemain) >= 0) {\r
-        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];\r
         if (Sd->mOutBuf >= Sd->mOrigSize) {\r
           return ;\r
         }\r
+        if (DataIdx >= Sd->mOrigSize) {\r
+          Sd->mBadTableFlag = (UINT16) BAD_TABLE;\r
+          return ;\r
+        }\r
+        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];\r
 \r
         BytesRemain--;\r
       }\r
@@ -684,6 +696,7 @@ Returns:
 --*/\r
 {\r
   UINT8 *Src;\r
+  UINT32 CompSize;\r
 \r
   *ScratchSize  = sizeof (SCRATCH_DATA);\r
 \r
@@ -692,7 +705,13 @@ Returns:
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
+  CompSize = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24);\r
   *DstSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);\r
+\r
+  if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   return EFI_SUCCESS;\r
 }\r
 \r
@@ -752,7 +771,7 @@ Returns:
   CompSize  = Src[0] + (Src[1] << 8) + (Src[2] << 16) + (Src[3] << 24);\r
   OrigSize  = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);\r
 \r
-  if (SrcSize < CompSize + 8) {\r
+  if (SrcSize < CompSize + 8 || (CompSize + 8) < 8) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r

diff --git a/BaseTools/Source/C/TianoCompress/TianoCompress.c b/BaseTools/Source/C/TianoCompress/TianoCompress.c
index b88d7da2ed2f8ec459de82569b46e9ba51a5c078..2d6fc4c952cfa5e4bbe2513c286de781676b2bfb 100644 (file)
--- a/BaseTools/Source/C/TianoCompress/TianoCompress.c
+++ b/BaseTools/Source/C/TianoCompress/TianoCompress.c
@@ -1757,6 +1757,7 @@ Returns:
   SCRATCH_DATA      *Scratch;\r
   UINT8      *Src;\r
   UINT32     OrigSize;\r
+  UINT32     CompSize;\r
 \r
   SetUtilityName(UTILITY_NAME);\r
 \r
@@ -1765,6 +1766,7 @@ Returns:
   OutBuffer = NULL;\r
   Scratch   = NULL;\r
   OrigSize = 0;\r
+  CompSize = 0;\r
   InputLength = 0;\r
   InputFileName = NULL;\r
   OutputFileName = NULL;\r
@@ -2006,15 +2008,24 @@ Returns:
     }\r
     fwrite(OutBuffer, (size_t)(DstSize), 1, OutputFile);\r
   } else {\r
+    if (InputLength < 8){\r
+      Error (NULL, 0, 3000, "Invalid", "The input file %s is too small.", InputFileName);\r
+      goto ERROR;\r
+    }\r
     //\r
     // Get Compressed file original size\r
     //\r
     Src     = (UINT8 *)FileBuffer;\r
     OrigSize  = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24);\r
+    CompSize  = Src[0] + (Src[1] << 8) + (Src[2] <<16) + (Src[3] <<24);\r
 \r
     //\r
     // Allocate OutputBuffer\r
     //\r
+    if (InputLength < CompSize + 8 || (CompSize + 8) < 8) {\r
+      Error (NULL, 0, 3000, "Invalid", "The input file %s data is invalid.", InputFileName);\r
+      goto ERROR;\r
+    }\r
     OutBuffer = (UINT8 *)malloc(OrigSize);\r
     if (OutBuffer == NULL) {\r
       Error (NULL, 0, 4001, "Resource:", "Memory cannot be allocated!");\r
@@ -2204,12 +2215,16 @@ Returns:
   UINT16  Mask;\r
   UINT16  WordOfStart;\r
   UINT16  WordOfCount;\r
+  UINT16  MaxTableLength;\r
 \r
   for (Index = 0; Index <= 16; Index++) {\r
     Count[Index] = 0;\r
   }\r
 \r
   for (Index = 0; Index < NumOfChar; Index++) {\r
+    if (BitLen[Index] > 16) {\r
+      return (UINT16) BAD_TABLE;\r
+    }\r
     Count[BitLen[Index]]++;\r
   }\r
 \r
@@ -2253,6 +2268,7 @@ Returns:
 \r
   Avail = NumOfChar;\r
   Mask  = (UINT16) (1U << (15 - TableBits));\r
+  MaxTableLength = (UINT16) (1U << TableBits);\r
 \r
   for (Char = 0; Char < NumOfChar; Char++) {\r
 \r
@@ -2266,6 +2282,9 @@ Returns:
     if (Len <= TableBits) {\r
 \r
       for (Index = Start[Len]; Index < NextCode; Index++) {\r
+        if (Index >= MaxTableLength) {\r
+          return (UINT16) BAD_TABLE;\r
+        }\r
         Table[Index] = Char;\r
       }\r
 \r
@@ -2650,11 +2669,16 @@ Returns: (VOID)
       DataIdx     = Sd->mOutBuf - DecodeP (Sd) - 1;\r
 \r
       BytesRemain--;\r
+\r
       while ((INT16) (BytesRemain) >= 0) {\r
-        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];\r
         if (Sd->mOutBuf >= Sd->mOrigSize) {\r
           goto Done ;\r
         }\r
+        if (DataIdx >= Sd->mOrigSize) {\r
+          Sd->mBadTableFlag = (UINT16) BAD_TABLE;\r
+          goto Done ;\r
+        }\r
+        Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];\r
 \r
         BytesRemain--;\r
       }\r