Fix TCG protocol PassThroughToTpm() SDL issue

Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by  : Dong Guo <guo.dong@intel.com>
Reviewed-by  : Fu, Siyuan <siyuan.fu@intel.com>

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13646 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Tcg/TcgDxe/TcgDxe.c b/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
index 75c6a8978f45c4ac1778802a76d5b29e57866748..fea59c35b6cecf1c51a8500326fea855f829d41a 100644 (file)
--- a/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
+++ b/SecurityPkg/Tcg/TcgDxe/TcgDxe.c
@@ -1,6 +1,13 @@
 /** @file  \r
   This module implements TCG EFI Protocol.\r
-  \r
+ \r
+Caution: This module requires additional review when modified.\r
+This driver will have external input - TcgDxePassThroughToTpm\r
+This external input must be validated carefully to avoid security issue like\r
+buffer overflow, integer overflow.\r
+\r
+TcgDxePassThroughToTpm() will receive untrusted input and do basic validation.\r
+\r
 Copyright (c) 2005 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
@@ -384,6 +391,13 @@ TcgDxePassThroughToTpm (
 {\r
   TCG_DXE_DATA                      *TcgData;\r
 \r
+  if (TpmInputParameterBlock == NULL || \r
+      TpmOutputParameterBlock == NULL || \r
+      TpmInputParameterBlockSize == 0 ||\r
+      TpmOutputParameterBlockSize == 0) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   TcgData = TCG_DXE_DATA_FROM_THIS (This);\r
 \r
   return TisPcExecute (\r

diff --git a/SecurityPkg/Tcg/TcgDxe/TisDxe.c b/SecurityPkg/Tcg/TcgDxe/TisDxe.c
index 68489d3e3f1ce29ef005324df32b459b8fa91d06..e7e0f9e405577904364151433cba7b092dca5e62 100644 (file)
--- a/SecurityPkg/Tcg/TcgDxe/TisDxe.c
+++ b/SecurityPkg/Tcg/TcgDxe/TisDxe.c
@@ -233,6 +233,13 @@ TisPcSendV (
       return EFI_INVALID_PARAMETER;\r
   }\r
 \r
+  //\r
+  // Check input to avoid overflow.\r
+  //\r
+  if ((UINT32) (~0)- *DataLength < (UINT32)Size) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   if(*DataLength + (UINT32) Size > TPMCMDBUFLENGTH) {\r
     return EFI_BUFFER_TOO_SMALL;\r
   }\r
@@ -291,9 +298,16 @@ TisPcReceiveV (
 \r
     case 'r':\r
       Size = VA_ARG (*ap, UINTN);\r
-      if(*DataIndex + (UINT32) Size <= RespSize) {\r
-        break;\r
+      //\r
+      // If overflowed, which means Size is big enough for Response data. \r
+      // skip this check. Copy the whole data \r
+      //\r
+      if ((UINT32) (~0)- *DataIndex >= (UINT32)Size) {\r
+        if(*DataIndex + (UINT32) Size <= RespSize) {\r
+          break;\r
+        }\r
       }\r
+\r
       *DataFinished = TRUE;\r
       if (*DataIndex >= RespSize) {\r
         return EFI_SUCCESS;\r