BaseTools/C/Common: Avoid possible NULL pointer dereference

Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

diff --git a/BaseTools/Source/C/Common/BasePeCoff.c b/BaseTools/Source/C/Common/BasePeCoff.c
index d0cc1af246302c3af493d4de7d61a886ccdff685..9adbdfaf09da202c25a939ec914ac45cccb6de18 100644 (file)
--- a/BaseTools/Source/C/Common/BasePeCoff.c
+++ b/BaseTools/Source/C/Common/BasePeCoff.c
@@ -650,6 +650,10 @@ Returns:
                         ImageContext,\r
                         RelocDir->VirtualAddress + RelocDir->Size - 1\r
                         );\r
+        if (RelocBase == NULL || RelocBaseEnd == NULL || RelocBaseEnd < RelocBase) {\r
+          ImageContext->ImageError = IMAGE_ERROR_FAILED_RELOCATION;\r
+          return RETURN_LOAD_ERROR;\r
+        }\r
       } else {\r
         //\r
         // Set base and end to bypass processing below.\r
@@ -674,6 +678,10 @@ Returns:
                         ImageContext,\r
                         RelocDir->VirtualAddress + RelocDir->Size - 1\r
                         );\r
+        if (RelocBase == NULL || RelocBaseEnd == NULL || RelocBaseEnd < RelocBase) {\r
+          ImageContext->ImageError = IMAGE_ERROR_FAILED_RELOCATION;\r
+          return RETURN_LOAD_ERROR;\r
+        }\r
       } else {\r
         //\r
         // Set base and end to bypass processing below.\r
@@ -710,6 +718,10 @@ Returns:
     RelocEnd  = (UINT16 *) ((CHAR8 *) RelocBase + RelocBase->SizeOfBlock);\r
     if (!(ImageContext->IsTeImage)) {\r
       FixupBase = PeCoffLoaderImageAddress (ImageContext, RelocBase->VirtualAddress);\r
+      if (FixupBase == NULL) {\r
+        ImageContext->ImageError = IMAGE_ERROR_FAILED_RELOCATION;\r
+        return RETURN_LOAD_ERROR;\r
+      }\r
     } else {\r
       FixupBase = (CHAR8 *)(UINTN)(ImageContext->ImageAddress +\r
                     RelocBase->VirtualAddress +\r

diff --git a/BaseTools/Source/C/Common/EfiUtilityMsgs.c b/BaseTools/Source/C/Common/EfiUtilityMsgs.c
index 438f338a915cefa0cea7e88c2d05b52ae5bf00ab..7b4c2310ca9fd2c974fe6d4ba370f89e056ca43d 100644 (file)
--- a/BaseTools/Source/C/Common/EfiUtilityMsgs.c
+++ b/BaseTools/Source/C/Common/EfiUtilityMsgs.c
@@ -1,7 +1,7 @@
 /** @file\r
 EFI tools utility functions to display warning, error, and informational messages\r
 \r
-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -451,14 +451,16 @@ Notes:
     //\r
     time (&CurrentTime);\r
     NewTime = localtime (&CurrentTime);\r
-    fprintf (stdout, "%04d-%02d-%02d %02d:%02d:%02d",\r
-                     NewTime->tm_year + 1900,\r
-                     NewTime->tm_mon + 1,\r
-                     NewTime->tm_mday,\r
-                     NewTime->tm_hour,\r
-                     NewTime->tm_min,\r
-                     NewTime->tm_sec\r
-                     );\r
+    if (NewTime != NULL) {\r
+      fprintf (stdout, "%04d-%02d-%02d %02d:%02d:%02d",\r
+                       NewTime->tm_year + 1900,\r
+                       NewTime->tm_mon + 1,\r
+                       NewTime->tm_mday,\r
+                       NewTime->tm_hour,\r
+                       NewTime->tm_min,\r
+                       NewTime->tm_sec\r
+                       );\r
+    }\r
     if (Cptr != NULL) {\r
       sprintf (Line, ": %s", Cptr);\r
       if (LineNumber != 0) {\r

diff --git a/BaseTools/Source/C/Common/FirmwareVolumeBuffer.c b/BaseTools/Source/C/Common/FirmwareVolumeBuffer.c
index 7988d8e43a059a62dfac85d0f4528a153e1f8767..a287fe1597a64c9e7ca9538b6714c12056e43d03 100644 (file)
--- a/BaseTools/Source/C/Common/FirmwareVolumeBuffer.c
+++ b/BaseTools/Source/C/Common/FirmwareVolumeBuffer.c
@@ -1,7 +1,7 @@
 /** @file\r
 EFI Firmware Volume routines which work on a Fv image in buffers.\r
 \r
-Copyright (c) 1999 - 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 1999 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -353,6 +353,9 @@ Returns:
 \r
   if (*DestinationFv == NULL) {\r
     *DestinationFv = CommonLibBinderAllocate (size);\r
+    if (*DestinationFv == NULL) {\r
+      return EFI_OUT_OF_RESOURCES;\r
+    }\r
   }\r
 \r
   CommonLibBinderCopyMem (*DestinationFv, SourceFv, size);\r

diff --git a/BaseTools/Source/C/Common/MyAlloc.c b/BaseTools/Source/C/Common/MyAlloc.c
index eabba5790d2e0248f1e4b0899394fdbceee2da6f..be7c515a6067dd72b6f9782f5c17bbd1e1e71821 100644 (file)
--- a/BaseTools/Source/C/Common/MyAlloc.c
+++ b/BaseTools/Source/C/Common/MyAlloc.c
@@ -1,7 +1,7 @@
 /** @file\r
 File for memory allocation tracking functions.\r
 \r
-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -73,7 +73,18 @@ MyCheck (
   //\r
   // Check parameters.\r
   //\r
-  if (File == NULL || Line == 0) {\r
+  if (File == NULL) {\r
+    printf (\r
+      "\nMyCheck(Final=%u, File=NULL, Line=%u)"\r
+      "Invalid parameter(s).\n",\r
+      Final,\r
+      (unsigned)Line\r
+      );\r
+\r
+    exit (1);\r
+  }\r
+\r
+  if (Line == 0) {\r
     printf (\r
       "\nMyCheck(Final=%u, File=%s, Line=%u)"\r
       "Invalid parameter(s).\n",\r
@@ -190,7 +201,18 @@ MyAlloc (
   //\r
   // Check for invalid parameters.\r
   //\r
-  if (Size == 0 || File == NULL || Line == 0) {\r
+  if (File == NULL) {\r
+    printf (\r
+      "\nMyAlloc(Size=%u, File=NULL, Line=%u)"\r
+      "\nInvalid parameter(s).\n",\r
+      (unsigned)Size,\r
+      (unsigned)Line\r
+      );\r
+\r
+    exit (1);\r
+  }\r
+\r
+  if (Size == 0 || Line == 0) {\r
     printf (\r
       "\nMyAlloc(Size=%u, File=%s, Line=%u)"\r
       "\nInvalid parameter(s).\n",\r
@@ -303,7 +325,19 @@ MyRealloc (
   //\r
   // Check for invalid parameter(s).\r
   //\r
-  if (Size == 0 || File == NULL || Line == 0) {\r
+  if (File == NULL) {\r
+    printf (\r
+      "\nMyRealloc(Ptr=%p, Size=%u, File=NULL, Line=%u)"\r
+      "\nInvalid parameter(s).\n",\r
+      Ptr,\r
+      (unsigned)Size,\r
+      (unsigned)Line\r
+      );\r
+\r
+    exit (1);\r
+  }\r
+\r
+  if (Size == 0 || Line == 0) {\r
     printf (\r
       "\nMyRealloc(Ptr=%p, Size=%u, File=%s, Line=%u)"\r
       "\nInvalid parameter(s).\n",\r
@@ -408,7 +442,18 @@ MyFree (
   //\r
   // Check for invalid parameter(s).\r
   //\r
-  if (File == NULL || Line == 0) {\r
+  if (File == NULL) {\r
+    printf (\r
+      "\nMyFree(Ptr=%p, File=NULL, Line=%u)"\r
+      "\nInvalid parameter(s).\n",\r
+      Ptr,\r
+      (unsigned)Line\r
+      );\r
+\r
+    exit (1);\r
+  }\r
+\r
+  if (Line == 0) {\r
     printf (\r
       "\nMyFree(Ptr=%p, File=%s, Line=%u)"\r
       "\nInvalid parameter(s).\n",\r

diff --git a/BaseTools/Source/C/Common/ParseGuidedSectionTools.c b/BaseTools/Source/C/Common/ParseGuidedSectionTools.c
index e3f0ccb597df6e106c287f53b1fa5292ee2cf391..fc8f488f7e46e646c30a62b6e9a305bcc7c90077 100644 (file)
--- a/BaseTools/Source/C/Common/ParseGuidedSectionTools.c
+++ b/BaseTools/Source/C/Common/ParseGuidedSectionTools.c
@@ -1,7 +1,7 @@
 /** @file\r
 Helper functions for parsing GuidedSectionTools.txt\r
 \r
-Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -144,13 +144,14 @@ Returns:
           NewGuidTool->Name = CloneString(Tool->Strings[1]);\r
           NewGuidTool->Path = CloneString(Tool->Strings[2]);\r
           NewGuidTool->Next = NULL;\r
+\r
+          if (FirstGuidTool == NULL) {\r
+            FirstGuidTool = NewGuidTool;\r
+          } else {\r
+            LastGuidTool->Next = NewGuidTool;\r
+          }\r
+          LastGuidTool = NewGuidTool;\r
         }\r
-        if (FirstGuidTool == NULL) {\r
-          FirstGuidTool = NewGuidTool;\r
-        } else {\r
-          LastGuidTool->Next = NewGuidTool;\r
-        }\r
-        LastGuidTool = NewGuidTool;\r
       }\r
       FreeStringList (Tool);\r
     }\r

diff --git a/BaseTools/Source/C/Common/TianoCompress.c b/BaseTools/Source/C/Common/TianoCompress.c
index e5175fcffea2cd4f4667972e6db1bd875cbf9f08..252b8291ed4badb7ac1e7a7aa5a275fbd214a724 100644 (file)
--- a/BaseTools/Source/C/Common/TianoCompress.c
+++ b/BaseTools/Source/C/Common/TianoCompress.c
@@ -4,7 +4,7 @@ coding. LZ77 transforms the source data into a sequence of Original Characters
 and Pointers to repeated strings. This sequence is further divided into Blocks \r
 and Huffman codings are applied to each Block.\r
   \r
-Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -417,6 +417,9 @@ Returns:
   UINT32  Index;\r
 \r
   mText = malloc (WNDSIZ * 2 + MAXMATCH);\r
+  if (mText == NULL) {\r
+    return EFI_OUT_OF_RESOURCES;\r
+  }\r
   for (Index = 0; Index < WNDSIZ * 2 + MAXMATCH; Index++) {\r
     mText[Index] = 0;\r
   }\r
@@ -427,6 +430,10 @@ Returns:
   mParent     = malloc (WNDSIZ * 2 * sizeof (*mParent));\r
   mPrev       = malloc (WNDSIZ * 2 * sizeof (*mPrev));\r
   mNext       = malloc ((MAX_HASH_VAL + 1) * sizeof (*mNext));\r
+  if (mLevel == NULL || mChildCount == NULL || mPosition == NULL ||\r
+    mParent == NULL || mPrev == NULL || mNext == NULL) {\r
+    return EFI_OUT_OF_RESOURCES;\r
+  }\r
 \r
   mBufSiz     = BLKSIZ;\r
   mBuf        = malloc (mBufSiz);\r