Add more check for the bmp file to avoid access violation.

Signed-off-by: Dong Eric <eric.dong@intel.com>
Reviewed-by: Gao Liming <liming.gao@intel.com>
Reviewed-by: Zhang Chao <chao.b.zhang@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13185 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/EdkCompatibilityPkg/Foundation/Library/Dxe/Graphics/Graphics.c b/EdkCompatibilityPkg/Foundation/Library/Dxe/Graphics/Graphics.c
index 6a8183e13185a16c10e5c3dae521cc7d604117c1..95492173885860624ca616ca9b58bc57341b463b 100644 (file)
--- a/EdkCompatibilityPkg/Foundation/Library/Dxe/Graphics/Graphics.c
+++ b/EdkCompatibilityPkg/Foundation/Library/Dxe/Graphics/Graphics.c
@@ -1,6 +1,6 @@
 /*++\r
 \r
-Copyright (c) 2004 - 2010, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -162,22 +162,78 @@ Returns:
   UINTN                         Height;\r
   UINTN                         Width;\r
   UINTN                         ImageIndex;\r
+  UINTN                         DataSizePerLine;\r
   BOOLEAN                       IsAllocated;\r
+  UINT32                        ColorMapNum;\r
+\r
+  if (sizeof (BMP_IMAGE_HEADER) > BmpImageSize) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
 \r
   BmpHeader = (BMP_IMAGE_HEADER *) BmpImage;\r
+\r
   if (BmpHeader->CharB != 'B' || BmpHeader->CharM != 'M') {\r
     return EFI_UNSUPPORTED;\r
   }\r
 \r
+  //\r
+  // Doesn't support compress.\r
+  //\r
   if (BmpHeader->CompressionType != 0) {\r
     return EFI_UNSUPPORTED;\r
   }\r
 \r
+  //\r
+  // Only support BITMAPINFOHEADER format.\r
+  // BITMAPFILEHEADER + BITMAPINFOHEADER = BMP_IMAGE_HEADER\r
+  //\r
+  if (BmpHeader->HeaderSize != sizeof (BMP_IMAGE_HEADER) - ((UINTN) &(((BMP_IMAGE_HEADER *)0)->HeaderSize))) {\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
+  //\r
+  // The data size in each line must be 4 byte alignment.\r
+  //\r
+  DataSizePerLine = ((BmpHeader->PixelWidth * BmpHeader->BitPerPixel + 31) >> 3) & (~0x3);\r
+  BltBufferSize = MultU64x32 (DataSizePerLine, BmpHeader->PixelHeight);\r
+  if (BltBufferSize > (UINT32) ~0) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  if ((BmpHeader->Size != BmpImageSize) || \r
+      (BmpHeader->Size < BmpHeader->ImageOffset) ||\r
+      (BmpHeader->Size - BmpHeader->ImageOffset !=  BmpHeader->PixelHeight * DataSizePerLine)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   //\r
   // Calculate Color Map offset in the image.\r
   //\r
   Image       = BmpImage;\r
   BmpColorMap = (BMP_COLOR_MAP *) (Image + sizeof (BMP_IMAGE_HEADER));\r
+  if (BmpHeader->ImageOffset < sizeof (BMP_IMAGE_HEADER)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  if (BmpHeader->ImageOffset > sizeof (BMP_IMAGE_HEADER)) {\r
+    switch (BmpHeader->BitPerPixel) {\r
+      case 1:\r
+        ColorMapNum = 2;\r
+        break;\r
+      case 4:\r
+        ColorMapNum = 16;\r
+        break;\r
+      case 8:\r
+        ColorMapNum = 256;\r
+        break;\r
+      default:\r
+        ColorMapNum = 0;\r
+        break;\r
+      }\r
+    if (BmpHeader->ImageOffset - sizeof (BMP_IMAGE_HEADER) != sizeof (BMP_COLOR_MAP) * ColorMapNum) {\r
+      return EFI_INVALID_PARAMETER;\r
+    }\r
+  }\r
 \r
   //\r
   // Calculate graphics image data address in the image\r

diff --git a/EdkCompatibilityPkg/Foundation/Library/Dxe/GraphicsLite/Graphics.c b/EdkCompatibilityPkg/Foundation/Library/Dxe/GraphicsLite/Graphics.c
index cfdccc54553d1e3422652097f04477cdb45ba059..5123aacf4573109663eb826af4d7ff4aa43526b8 100644 (file)
--- a/EdkCompatibilityPkg/Foundation/Library/Dxe/GraphicsLite/Graphics.c
+++ b/EdkCompatibilityPkg/Foundation/Library/Dxe/GraphicsLite/Graphics.c
@@ -1,6 +1,6 @@
 /*++\r
 \r
-Copyright (c) 2004 - 2010, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -163,22 +163,78 @@ Returns:
   UINTN                         Height;\r
   UINTN                         Width;\r
   UINTN                         ImageIndex;\r
+  UINTN                         DataSizePerLine;\r
   BOOLEAN                       IsAllocated;\r
+  UINT32                        ColorMapNum;\r
+\r
+  if (sizeof (BMP_IMAGE_HEADER) > BmpImageSize) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
 \r
   BmpHeader = (BMP_IMAGE_HEADER *) BmpImage;\r
+\r
   if (BmpHeader->CharB != 'B' || BmpHeader->CharM != 'M') {\r
     return EFI_UNSUPPORTED;\r
   }\r
 \r
+  //\r
+  // Doesn't support compress.\r
+  //\r
   if (BmpHeader->CompressionType != 0) {\r
     return EFI_UNSUPPORTED;\r
   }\r
 \r
+  //\r
+  // Only support BITMAPINFOHEADER format.\r
+  // BITMAPFILEHEADER + BITMAPINFOHEADER = BMP_IMAGE_HEADER\r
+  //\r
+  if (BmpHeader->HeaderSize != sizeof (BMP_IMAGE_HEADER) - ((UINTN) &(((BMP_IMAGE_HEADER *)0)->HeaderSize))) {\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
+  //\r
+  // The data size in each line must be 4 byte alignment.\r
+  //\r
+  DataSizePerLine = ((BmpHeader->PixelWidth * BmpHeader->BitPerPixel + 31) >> 3) & (~0x3);\r
+  BltBufferSize = MultU64x32 (DataSizePerLine, BmpHeader->PixelHeight);\r
+  if (BltBufferSize > (UINT32) ~0) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  if ((BmpHeader->Size != BmpImageSize) || \r
+      (BmpHeader->Size < BmpHeader->ImageOffset) ||\r
+      (BmpHeader->Size - BmpHeader->ImageOffset !=  BmpHeader->PixelHeight * DataSizePerLine)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   //\r
   // Calculate Color Map offset in the image.\r
   //\r
   Image       = BmpImage;\r
   BmpColorMap = (BMP_COLOR_MAP *) (Image + sizeof (BMP_IMAGE_HEADER));\r
+  if (BmpHeader->ImageOffset < sizeof (BMP_IMAGE_HEADER)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  if (BmpHeader->ImageOffset > sizeof (BMP_IMAGE_HEADER)) {\r
+    switch (BmpHeader->BitPerPixel) {\r
+      case 1:\r
+        ColorMapNum = 2;\r
+        break;\r
+      case 4:\r
+        ColorMapNum = 16;\r
+        break;\r
+      case 8:\r
+        ColorMapNum = 256;\r
+        break;\r
+      default:\r
+        ColorMapNum = 0;\r
+        break;\r
+      }\r
+    if (BmpHeader->ImageOffset - sizeof (BMP_IMAGE_HEADER) != sizeof (BMP_COLOR_MAP) * ColorMapNum) {\r
+      return EFI_INVALID_PARAMETER;\r
+    }\r
+  }\r
 \r
   //\r
   // Calculate graphics image data address in the image\r

diff --git a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
index 4fca0f3b12e076bf36f6dc962964ced518e994b6..1ded13637d3c608e8f613549c8a9665341456d47 100644 (file)
--- a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
+++ b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
@@ -601,7 +601,13 @@ ConvertBmpToGopBlt (
   UINTN                         Height;\r
   UINTN                         Width;\r
   UINTN                         ImageIndex;\r
+  UINT32                        DataSizePerLine;\r
   BOOLEAN                       IsAllocated;\r
+  UINT32                        ColorMapNum;\r
+\r
+  if (sizeof (BMP_IMAGE_HEADER) > BmpImageSize) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
 \r
   BmpHeader = (BMP_IMAGE_HEADER *) BmpImage;\r
 \r
@@ -616,11 +622,57 @@ ConvertBmpToGopBlt (
     return EFI_UNSUPPORTED;\r
   }\r
 \r
+  //\r
+  // Only support BITMAPINFOHEADER format.\r
+  // BITMAPFILEHEADER + BITMAPINFOHEADER = BMP_IMAGE_HEADER\r
+  //\r
+  if (BmpHeader->HeaderSize != sizeof (BMP_IMAGE_HEADER) - OFFSET_OF(BMP_IMAGE_HEADER, HeaderSize)) {\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r
+  //\r
+  // The data size in each line must be 4 byte alignment.\r
+  //\r
+  DataSizePerLine = ((BmpHeader->PixelWidth * BmpHeader->BitPerPixel + 31) >> 3) & (~0x3);\r
+  BltBufferSize = MultU64x32 (DataSizePerLine, BmpHeader->PixelHeight);\r
+  if (BltBufferSize > (UINT32) ~0) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  if ((BmpHeader->Size != BmpImageSize) || \r
+      (BmpHeader->Size < BmpHeader->ImageOffset) ||\r
+      (BmpHeader->Size - BmpHeader->ImageOffset !=  BmpHeader->PixelHeight * DataSizePerLine)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   //\r
   // Calculate Color Map offset in the image.\r
   //\r
   Image       = BmpImage;\r
   BmpColorMap = (BMP_COLOR_MAP *) (Image + sizeof (BMP_IMAGE_HEADER));\r
+  if (BmpHeader->ImageOffset < sizeof (BMP_IMAGE_HEADER)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  if (BmpHeader->ImageOffset > sizeof (BMP_IMAGE_HEADER)) {\r
+    switch (BmpHeader->BitPerPixel) {\r
+      case 1:\r
+        ColorMapNum = 2;\r
+        break;\r
+      case 4:\r
+        ColorMapNum = 16;\r
+        break;\r
+      case 8:\r
+        ColorMapNum = 256;\r
+        break;\r
+      default:\r
+        ColorMapNum = 0;\r
+        break;\r
+      }\r
+    if (BmpHeader->ImageOffset - sizeof (BMP_IMAGE_HEADER) != sizeof (BMP_COLOR_MAP) * ColorMapNum) {\r
+      return EFI_INVALID_PARAMETER;\r
+    }\r
+  }\r
 \r
   //\r
   // Calculate graphics image data address in the image\r
@@ -636,8 +688,8 @@ ConvertBmpToGopBlt (
   // Ensure the BltBufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) doesn't overflow\r
   //\r
   if (BltBufferSize > DivU64x32 ((UINTN) ~0, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL))) {\r
-      return EFI_UNSUPPORTED;\r
-   }\r
+    return EFI_UNSUPPORTED;\r
+  }\r
   BltBufferSize = MultU64x32 (BltBufferSize, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL));\r
 \r
   IsAllocated   = FALSE;\r
@@ -798,6 +850,7 @@ EnableQuietBoot (
   UINTN                         NewDestY;\r
   UINTN                         NewHeight;\r
   UINTN                         NewWidth;\r
+  UINT64                        BufferSize;\r
 \r
   UgaDraw = NULL;\r
   //\r
@@ -1082,7 +1135,22 @@ Done:
       FreePool (Blt);\r
     }\r
 \r
-    LogoBlt = AllocateZeroPool (LogoWidth * LogoHeight * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL));\r
+    //\r
+    // Ensure the LogoHeight * LogoWidth doesn't overflow\r
+    //\r
+    if (LogoHeight > DivU64x64Remainder ((UINTN) ~0, LogoWidth, NULL)) {\r
+      return EFI_UNSUPPORTED;\r
+    }\r
+    BufferSize = MultU64x64 (LogoWidth, LogoHeight);\r
+\r
+    //\r
+    // Ensure the BufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) doesn't overflow\r
+    //\r
+    if (BufferSize > DivU64x32 ((UINTN) ~0, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL))) {\r
+      return EFI_UNSUPPORTED;\r
+    }\r
+\r
+    LogoBlt = AllocateZeroPool ((UINTN)BufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL));\r
     if (LogoBlt == NULL) {\r
       return EFI_OUT_OF_RESOURCES;\r
     }\r

diff --git a/MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.c b/MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.c
index d36598538963a95a0e3d67a8d4b7ac3193bbbced..df770fc6478de7ed50fb43e0dc0fc7196cb0ae5b 100644 (file)
--- a/MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.c
+++ b/MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.c
@@ -157,6 +157,8 @@ SetBootLogo (
   IN UINTN                             Height\r
   )\r
 {\r
+  UINT64                        BufferSize;\r
+\r
   if (BltBuffer == NULL) {\r
     mIsLogoValid = FALSE;\r
     mAcpiBgrtStatusChanged = TRUE;\r
@@ -172,9 +174,24 @@ SetBootLogo (
     FreePool (mLogoBltBuffer);\r
     mLogoBltBuffer = NULL;\r
   }\r
+  \r
+  //\r
+  // Ensure the Height * Width doesn't overflow\r
+  //\r
+  if (Height > DivU64x64Remainder ((UINTN) ~0, Width, NULL)) {\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+  BufferSize = MultU64x64 (Width, Height);\r
+  \r
+  //\r
+  // Ensure the BufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) doesn't overflow\r
+  //\r
+  if (BufferSize > DivU64x32 ((UINTN) ~0, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL))) {\r
+    return EFI_UNSUPPORTED;\r
+  }\r
 \r
   mLogoBltBuffer = AllocateCopyPool (\r
-                     Width * Height * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL),\r
+                     (UINTN)BufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL),\r
                      BltBuffer\r
                      );\r
   if (mLogoBltBuffer == NULL) {\r
@@ -330,6 +347,21 @@ InstallBootGraphicsResourceTable (
     // Allocate memory for BMP file.\r
     //\r
     PaddingSize = mLogoWidth & 0x3;\r
+\r
+    //\r
+    // First check mLogoWidth * 3 + PaddingSize doesn't overflow\r
+    //\r
+    if (mLogoWidth > (((UINT32) ~0) - PaddingSize) / 3 ) {\r
+      return EFI_UNSUPPORTED;\r
+    }\r
+\r
+    //\r
+    // Second check (mLogoWidth * 3 + PaddingSize) * mLogoHeight + sizeof (BMP_IMAGE_HEADER) doesn't overflow\r
+    //\r
+    if (mLogoHeight > (((UINT32) ~0) - sizeof (BMP_IMAGE_HEADER)) / (mLogoWidth * 3 + PaddingSize)) {\r
+      return EFI_UNSUPPORTED;\r
+    }\r
+    \r
     BmpSize = (mLogoWidth * 3 + PaddingSize) * mLogoHeight + sizeof (BMP_IMAGE_HEADER);\r
     ImageBuffer = BgrtAllocateReservedMemoryBelow4G (BmpSize);\r
     if (ImageBuffer == NULL) {\r