MdeModulePkg/PartitionDxe: Add check for underlying device block size

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=828

Within FindAnchorVolumeDescriptorPointer():

Add a check for the underlying device block size to ensure it is greater
than the size of an Anchor Volume Descriptor Pointer.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Paulo Alcantara <palcantara@suse.de>
Acked-by: Star Zeng <star.zeng@intel.com>

diff --git a/MdeModulePkg/Universal/Disk/PartitionDxe/Udf.c b/MdeModulePkg/Universal/Disk/PartitionDxe/Udf.c
index 83bd1742311a1bdc588ac55d2acd3b0b12bcf13c..49c56f6753b4e2d9e6db6e64be85289a2bf5258b 100644 (file)
--- a/MdeModulePkg/Universal/Disk/PartitionDxe/Udf.c
+++ b/MdeModulePkg/Universal/Disk/PartitionDxe/Udf.c
@@ -1,8 +1,17 @@
 /** @file\r
   Scan for an UDF file system on a formatted media.\r
 \r
+  Caution: This file requires additional review when modified.\r
+  This driver will have external input - CD/DVD media.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  FindUdfFileSystem() routine will consume the media properties and do basic\r
+  validation.\r
+\r
   Copyright (c) 2018 Qualcomm Datacenter Technologies, Inc.\r
   Copyright (C) 2014-2017 Paulo Alcantara <pcacjr@zytor.com>\r
+  Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials are licensed and made available\r
   under the terms and conditions of the BSD License which accompanies this\r
@@ -101,6 +110,20 @@ FindAnchorVolumeDescriptorPointer (
   *LastRecordedBlock = EndLBA;\r
   AvdpsCount = 0;\r
 \r
+  //\r
+  // Check if the block size of the underlying media can hold the data of an\r
+  // Anchor Volume Descriptor Pointer\r
+  //\r
+  if (BlockSize < sizeof (UDF_ANCHOR_VOLUME_DESCRIPTOR_POINTER)) {\r
+    DEBUG ((\r
+      DEBUG_ERROR,\r
+      "%a: Media block size 0x%x unable to hold an AVDP.\n",\r
+      __FUNCTION__,\r
+      BlockSize\r
+      ));\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
   //\r
   // Find AVDP at block 256\r
   //\r
@@ -598,6 +621,12 @@ Out_Free:
 /**\r
   Find a supported UDF file system in block device.\r
 \r
+  @attention This is boundary function that may receive untrusted input.\r
+  @attention The input is from Partition.\r
+\r
+  The CD/DVD media is the external input, so this routine will do basic\r
+  validation for the media.\r
+\r
   @param[in]  BlockIo             BlockIo interface.\r
   @param[in]  DiskIo              DiskIo interface.\r
   @param[out] StartingLBA         UDF file system starting LBA.\r