SecurityPkg : Fix Rsa2048Sha256GuidedSectionExtractLib issue

This issue causes section extraction overrun and possible hang due to bad output size calculation.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Cohen, Eugene" <eugene@hp.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18625 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c b/SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c
index 1f7a29904f3af1b7a1efffc4131a72976f7e8e67..5f5d242d6ee76a7163c76218252f5e204f3d1ebd 100644 (file)
--- a/SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c
+++ b/SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c
@@ -86,7 +86,7 @@ Rsa2048Sha256GuidedSectionGetInfo (
     //\r
     *SectionAttribute  = ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->Attributes;\r
     *ScratchBufferSize = 0;\r
-    *OutputBufferSize  = SECTION2_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->DataOffset;\r
+    *OutputBufferSize  = SECTION2_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION2_HEADER);\r
   } else {\r
     //\r
     // Check whether the input guid section is recognized.\r
@@ -101,7 +101,7 @@ Rsa2048Sha256GuidedSectionGetInfo (
     //\r
     *SectionAttribute  = ((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes;\r
     *ScratchBufferSize = 0;\r
-    *OutputBufferSize  = SECTION_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION *) InputSection)->DataOffset;\r
+    *OutputBufferSize  = SECTION_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION_HEADER);\r
   }\r
 \r
   return EFI_SUCCESS;\r

diff --git a/SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c b/SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c
index e2a0fb6708845eda93736172f2d24ee7f8aee171..e448164a5a33fea6275b8fd1e4e5afe0bd3787bd 100644 (file)
--- a/SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c
+++ b/SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c
@@ -84,7 +84,7 @@ Rsa2048Sha256GuidedSectionGetInfo (
     //\r
     *SectionAttribute  = ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->Attributes;\r
     *ScratchBufferSize = 0;\r
-    *OutputBufferSize  = SECTION2_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION2 *) InputSection)->DataOffset;\r
+    *OutputBufferSize  = SECTION2_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION2_HEADER);\r
   } else {\r
     //\r
     // Check whether the input guid section is recognized.\r
@@ -99,7 +99,7 @@ Rsa2048Sha256GuidedSectionGetInfo (
     //\r
     *SectionAttribute  = ((EFI_GUID_DEFINED_SECTION *) InputSection)->Attributes;\r
     *ScratchBufferSize = 0;\r
-    *OutputBufferSize  = SECTION_SIZE (InputSection) - ((EFI_GUID_DEFINED_SECTION *) InputSection)->DataOffset;\r
+    *OutputBufferSize  = SECTION_SIZE (InputSection) - sizeof(RSA_2048_SHA_256_SECTION_HEADER);\r
   }\r
 \r
   return EFI_SUCCESS;\r