Removes redundant code and adds data size check for certificate data in DxeImageVerif...

Signed-off by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Dong Eric <yong.dong@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13291 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index a591970e45cceefeac06dfb6b75e942f601f47e9..3e0bbe1ee4c771092fc4c9afc898ab0ffa629128 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -251,8 +251,6 @@ HashPeImage (
   EFI_IMAGE_SECTION_HEADER  *SectionHeader;\r
   UINTN                     Index;\r
   UINTN                     Pos;\r
   EFI_IMAGE_SECTION_HEADER  *SectionHeader;\r
   UINTN                     Index;\r
   UINTN                     Pos;\r

-  UINTN                     SumOfSectionBytes;\r
-  EFI_IMAGE_SECTION_HEADER  *SectionCache;\r

   UINT32                    CertSize;\r
   UINT32                    NumberOfRvaAndSizes;\r
 \r
   UINT32                    CertSize;\r
   UINT32                    NumberOfRvaAndSizes;\r
 \r


@@ -433,11 +431,6 @@ HashPeImage (
                mNtHeader.Pe32->FileHeader.SizeOfOptionalHeader\r
                );\r
 \r
                mNtHeader.Pe32->FileHeader.SizeOfOptionalHeader\r
                );\r
 \r

-  SectionCache = Section;\r
-  for (Index = 0, SumOfSectionBytes = 0; Index < mNtHeader.Pe32->FileHeader.NumberOfSections; Index++, SectionCache++) {\r
-    SumOfSectionBytes += SectionCache->SizeOfRawData;\r
-  }\r
-\r

   //\r
   // 11. Build a temporary table of pointers to all the IMAGE_SECTION_HEADER\r
   //     structures in the image. The 'NumberOfSections' field of the image\r
   //\r
   // 11. Build a temporary table of pointers to all the IMAGE_SECTION_HEADER\r
   //     structures in the image. The 'NumberOfSections' field of the image\r


@@ -557,6 +550,10 @@ HashPeImageByType (
 \r
   PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->VirtualAddress);\r
 \r
 \r
   PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->VirtualAddress);\r
 \r

+  if (PkcsCertData->Hdr.dwLength < sizeof (WIN_CERTIFICATE_EFI_PKCS) + 32) {\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r

   for (Index = 0; Index < HASHALG_MAX; Index++) {\r
     //\r
     // Check the Hash algorithm in PE/COFF Authenticode.\r
   for (Index = 0; Index < HASHALG_MAX; Index++) {\r
     //\r
     // Check the Hash algorithm in PE/COFF Authenticode.\r


@@ -577,6 +574,10 @@ HashPeImageByType (
       continue;\r
     }\r
 \r
       continue;\r
     }\r
 \r

+    if (PkcsCertData->Hdr.dwLength < sizeof (WIN_CERTIFICATE_EFI_PKCS) + 32 + mHash[Index].OidLength) {\r
+      return EFI_UNSUPPORTED;\r
+    }\r
+\r

     if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {\r
       break;\r
     }\r
     if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {\r
       break;\r
     }\r


@@ -1214,6 +1215,7 @@ DxeImageVerificationHandler (
   UINT8                                *SecureBootEnable;\r
   PE_COFF_LOADER_IMAGE_CONTEXT         ImageContext;\r
   UINT32                               NumberOfRvaAndSizes;\r
   UINT8                                *SecureBootEnable;\r
   PE_COFF_LOADER_IMAGE_CONTEXT         ImageContext;\r
   UINT32                               NumberOfRvaAndSizes;\r

+  UINT32                               CertSize;\r

 \r
   if (File == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
 \r
   if (File == NULL) {\r
     return EFI_INVALID_PARAMETER;\r


@@ -1321,7 +1323,9 @@ DxeImageVerificationHandler (
     goto Done;\r
   }\r
 \r
     goto Done;\r
   }\r
 \r

-  DosHdr      = (EFI_IMAGE_DOS_HEADER *) mImageBase;\r
+  Status = EFI_ACCESS_DENIED;\r
+\r
+  DosHdr = (EFI_IMAGE_DOS_HEADER *) mImageBase;\r

   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {\r
     //\r
     // DOS image header is present,\r
   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {\r
     //\r
     // DOS image header is present,\r


@@ -1339,7 +1343,6 @@ DxeImageVerificationHandler (
     //\r
     // It is not a valid Pe/Coff file.\r
     //\r
     //\r
     // It is not a valid Pe/Coff file.\r
     //\r

-    Status = EFI_ACCESS_DENIED;\r

     goto Done;\r
   }\r
 \r
     goto Done;\r
   }\r
 \r


@@ -1374,8 +1377,6 @@ DxeImageVerificationHandler (
       //\r
       // Image Hash is in forbidden database (DBX).\r
       //\r
       //\r
       // Image Hash is in forbidden database (DBX).\r
       //\r

-      Action = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;\r
-      Status = EFI_ACCESS_DENIED;\r

       goto Done;\r
     }\r
 \r
       goto Done;\r
     }\r
 \r


@@ -1389,8 +1390,6 @@ DxeImageVerificationHandler (
     //\r
     // Image Hash is not found in both forbidden and allowed database.\r
     //\r
     //\r
     // Image Hash is not found in both forbidden and allowed database.\r
     //\r

-    Action = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;\r
-    Status = EFI_ACCESS_DENIED;\r

     goto Done;\r
   }\r
 \r
     goto Done;\r
   }\r
 \r


@@ -1399,9 +1398,20 @@ DxeImageVerificationHandler (
   //\r
   WinCertificate = (WIN_CERTIFICATE *) (mImageBase + mSecDataDir->VirtualAddress);\r
 \r
   //\r
   WinCertificate = (WIN_CERTIFICATE *) (mImageBase + mSecDataDir->VirtualAddress);\r
 \r

+  CertSize = sizeof (WIN_CERTIFICATE);\r
+\r
+  if ((mSecDataDir->Size <= CertSize) || (mSecDataDir->Size < WinCertificate->dwLength)) {\r
+    goto Done;\r
+  }\r
+\r

   switch (WinCertificate->wCertificateType) {\r
 \r
   case WIN_CERT_TYPE_EFI_GUID:\r
   switch (WinCertificate->wCertificateType) {\r
 \r
   case WIN_CERT_TYPE_EFI_GUID:\r

+    CertSize = sizeof (WIN_CERTIFICATE_UEFI_GUID) + sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256) - sizeof (UINT8);\r
+    if (WinCertificate->dwLength < CertSize) {\r
+      goto Done;\r
+    }\r
+\r

     //\r
     // Verify UEFI GUID type.\r
     //\r
     //\r
     // Verify UEFI GUID type.\r
     //\r


@@ -1416,7 +1426,7 @@ DxeImageVerificationHandler (
     //\r
     // Verify Pkcs signed data type.\r
     //\r
     //\r
     // Verify Pkcs signed data type.\r
     //\r

-    Status    = HashPeImageByType();\r
+    Status = HashPeImageByType();\r

     if (EFI_ERROR (Status)) {\r
       goto Done;\r
     }\r
     if (EFI_ERROR (Status)) {\r
       goto Done;\r
     }\r


@@ -1435,7 +1445,6 @@ DxeImageVerificationHandler (
     break;\r
 \r
   default:\r
     break;\r
 \r
   default:\r

-    Status = EFI_ACCESS_DENIED;\r

     goto Done;\r
   }\r
   //\r
     goto Done;\r
   }\r
   //\r