MdeModulePkg/UdfDxe: Add checks to ensure no possible NULL ptr deref

Case 1 - Within DuplicateFid() & DuplicateFe():
The call to AllocateCopyPool() may return NULL.
Add ASSERTs as checks.

Case 2 - Within UdfRead():
Add ASSERT to ensure 'NewFileEntryData' returned from FindFileEntry()
will not be NULL pointer.

Case 3 - Within GetAllocationDescriptorLsn():
The return value of 'GetPdFromLongAd (Volume, ParentIcb)' may be NULL,
and it will be passed into function GetShortAdLsn() which will
dereference it.
Add ASSERT in GetShortAdLsn() as check.

Case 4 - Within ReadFile():
Add ASSERT to ensure 'Data' returned from GetAedAdsData() will not be NULL
pointer.

Case 5 - Within InternalFindFile():
If both 'Parent->FileIdentifierDesc' and 'Icb' are NULL, then possible
NULL pointer dereference will happen in ReadDirectoryEntry().
Add additional check to resolve.

Cc: Paulo Alcantara <pcacjr@zytor.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Paulo Alcantara <pcacjr@zytor.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>

diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/File.c b/MdeModulePkg/Universal/Disk/UdfDxe/File.c
index 01361141bbc3e707a0c9110c6123c8b18939a19a..82db75475b6d7120eb69a10c590687363991cb4b 100644 (file)
--- a/MdeModulePkg/Universal/Disk/UdfDxe/File.c
+++ b/MdeModulePkg/Universal/Disk/UdfDxe/File.c
@@ -427,6 +427,7 @@ UdfRead (
     if (EFI_ERROR (Status)) {\r
       goto Error_Find_Fe;\r
     }\r
+    ASSERT (NewFileEntryData != NULL);\r
 \r
     if (IS_FE_SYMLINK (NewFileEntryData)) {\r
       Status = ResolveSymlink (\r

diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
index 4609580b30160c1cf3795a1e75dc9cfba923fd56..02a73a9eb9e4d86b1f926d42b06fcad822e6bcc9 100644 (file)
--- a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
+++ b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
@@ -297,6 +297,8 @@ GetShortAdLsn (
   IN UDF_SHORT_ALLOCATION_DESCRIPTOR  *ShortAd\r
   )\r
 {\r
+  ASSERT (PartitionDesc != NULL);\r
+\r
   return (UINT64)PartitionDesc->PartitionStartingLocation +\r
     ShortAd->ExtentPosition;\r
 }\r
@@ -480,6 +482,8 @@ DuplicateFid (
   *NewFileIdentifierDesc =\r
     (UDF_FILE_IDENTIFIER_DESCRIPTOR *)AllocateCopyPool (\r
       (UINTN) GetFidDescriptorLength (FileIdentifierDesc), FileIdentifierDesc);\r
+\r
+  ASSERT (*NewFileIdentifierDesc != NULL);\r
 }\r
 \r
 //\r
@@ -494,6 +498,8 @@ DuplicateFe (
   )\r
 {\r
   *NewFileEntry = AllocateCopyPool (Volume->FileEntrySize, FileEntry);\r
+\r
+  ASSERT (*NewFileEntry != NULL);\r
 }\r
 \r
 //\r
@@ -1028,6 +1034,7 @@ ReadFile (
         if (EFI_ERROR (Status)) {\r
           goto Error_Get_Aed;\r
         }\r
+        ASSERT (Data != NULL);\r
 \r
         AdOffset = 0;\r
         continue;\r
@@ -1208,6 +1215,13 @@ InternalFindFile (
   CHAR16                          FoundFileName[UDF_FILENAME_LENGTH];\r
   VOID                            *CompareFileEntry;\r
 \r
+  //\r
+  // Check if both Parent->FileIdentifierDesc and Icb are NULL.\r
+  //\r
+  if ((Parent->FileIdentifierDesc == NULL) && (Icb == NULL)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   //\r
   // Check if parent file is really directory.\r
   //\r
@@ -1220,6 +1234,10 @@ InternalFindFile (
   // FE/EFE and FID descriptors.\r
   //\r
   if (StrCmp (FileName, L".") == 0) {\r
+    if (Parent->FileIdentifierDesc == NULL) {\r
+      return EFI_INVALID_PARAMETER;\r
+    }\r
+\r
     DuplicateFe (BlockIo, Volume, Parent->FileEntry, &File->FileEntry);\r
     DuplicateFid (Parent->FileIdentifierDesc, &File->FileIdentifierDesc);\r
 \r