Add comment for modules which have external input.

signed-off-by: jiewen.yao@intel.com
reviewed-by: guo.dong@intel.com
reviewed-by: ting.ye@intel.com
reviewed-by: liming.gao@intel.com
reviewed-by: elvin.li@intel.com

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13446 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
index 84faecd873070c84a6e37d5d99f4b8f62bd80062..3b4e69632849bb764eb24c4d4fd81a9d94ce05f2 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
@@ -1,6 +1,11 @@
 ## @file\r
 #  Cryptographic Library Instance for DXE_DRIVER.\r
 #\r
 ## @file\r
 #  Cryptographic Library Instance for DXE_DRIVER.\r
 #\r

+#  Caution: This module requires additional review when modified.\r
+#  This library will have external input - signature.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r

 #  Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r

diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
index e2c9f03b9a5fd8cff3b799ca7fce1fa4d4151144..e60c17ece0426a7d22765a7e5a9bbf2f5514c761 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
@@ -1,7 +1,12 @@
 ## @file\r
 #  Cryptographic Library Instance for PEIM.\r
 #\r
 ## @file\r
 #  Cryptographic Library Instance for PEIM.\r
 #\r

-#  Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>\r
+#  Caution: This module requires additional review when modified.\r
+#  This library will have external input - signature.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r
+#  Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r

 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  which accompanies this distribution.  The full text of the license may be found at\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  which accompanies this distribution.  The full text of the license may be found at\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
index a1f8c58e746de62a8ba7db54ca3a034236ca0c4a..a4f62b22b5675dd3589087d30849ce0ee527a82d 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptAuthenticode.c
@@ -1,6 +1,14 @@
 /** @file\r
   Authenticode Portable Executable Signature Verification over OpenSSL.\r
 \r
 /** @file\r
   Authenticode Portable Executable Signature Verification over OpenSSL.\r
 \r

+  Caution: This module requires additional review when modified.\r
+  This library will have external input - signature (e.g. PE/COFF Authenticode).\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  AuthenticodeVerify() will get PE/COFF Authenticode and will do basic check for\r
+  data structure.\r
+\r

 Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r


@@ -26,6 +34,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
   If AuthData is NULL, then return FALSE.\r
   If ImageHash is NULL, then return FALSE.\r
 \r
   If AuthData is NULL, then return FALSE.\r
   If ImageHash is NULL, then return FALSE.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  PE/COFF Authenticode is external input, so this function will do basic check for\r
+  Authenticode data structure.\r
+\r

   @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from signed\r
                            PE/COFF image to be verified.\r
   @param[in]  DataSize     Size of the Authenticode Signature in bytes.\r
   @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from signed\r
                            PE/COFF image to be verified.\r
   @param[in]  DataSize     Size of the Authenticode Signature in bytes.\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7.c
index 036412af5989650ebaf360f513e187fe3a07973d..ec6aa005ac09b85bb331a641c3bb277f0fd2080d 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7.c
@@ -1,6 +1,15 @@
 /** @file\r
   PKCS#7 SignedData Verification Wrapper Implementation over OpenSSL.\r
 \r
 /** @file\r
   PKCS#7 SignedData Verification Wrapper Implementation over OpenSSL.\r
 \r

+  Caution: This module requires additional review when modified.\r
+  This library will have external input - signature (e.g. UEFI Authenticated\r
+  Variable). It may by input in SMM mode.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  WrapPkcs7Data(), Pkcs7GetSigners(), Pkcs7Verify() will get UEFI Authenticated\r
+  Variable and will do basic check for data structure.\r
+\r

 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r


@@ -281,6 +290,10 @@ _Exit:
   Check input P7Data is a wrapped ContentInfo structure or not. If not construct\r
   a new structure to wrap P7Data.\r
 \r
   Check input P7Data is a wrapped ContentInfo structure or not. If not construct\r
   a new structure to wrap P7Data.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  UEFI Authenticated Variable is external input, so this function will do basic\r
+  check for PKCS#7 data structure.\r
+\r

   @param[in]  P7Data       Pointer to the PKCS#7 message to verify.\r
   @param[in]  P7Length     Length of the PKCS#7 message in bytes.\r
   @param[out] WrapFlag     If TRUE P7Data is a ContentInfo structure, otherwise\r
   @param[in]  P7Data       Pointer to the PKCS#7 message to verify.\r
   @param[in]  P7Length     Length of the PKCS#7 message in bytes.\r
   @param[out] WrapFlag     If TRUE P7Data is a ContentInfo structure, otherwise\r


@@ -389,6 +402,10 @@ WrapPkcs7Data (
   If P7Data, CertStack, StackLength, TrustedCert or CertLength is NULL, then\r
   return FALSE. If P7Length overflow, then return FAlSE.\r
 \r
   If P7Data, CertStack, StackLength, TrustedCert or CertLength is NULL, then\r
   return FALSE. If P7Length overflow, then return FAlSE.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  UEFI Authenticated Variable is external input, so this function will do basic\r
+  check for PKCS#7 data structure.\r
+\r

   @param[in]  P7Data       Pointer to the PKCS#7 message to verify.\r
   @param[in]  P7Length     Length of the PKCS#7 message in bytes.\r
   @param[out] CertStack    Pointer to Signer's certificates retrieved from P7Data.\r
   @param[in]  P7Data       Pointer to the PKCS#7 message to verify.\r
   @param[in]  P7Length     Length of the PKCS#7 message in bytes.\r
   @param[out] CertStack    Pointer to Signer's certificates retrieved from P7Data.\r


@@ -589,6 +606,10 @@ Pkcs7FreeSigners (
   If P7Data, TrustedCert or InData is NULL, then return FALSE.\r
   If P7Length, CertLength or DataLength overflow, then return FAlSE.\r
 \r
   If P7Data, TrustedCert or InData is NULL, then return FALSE.\r
   If P7Length, CertLength or DataLength overflow, then return FAlSE.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  UEFI Authenticated Variable is external input, so this function will do basic\r
+  check for PKCS#7 data structure.\r
+\r

   @param[in]  P7Data       Pointer to the PKCS#7 message to verify.\r
   @param[in]  P7Length     Length of the PKCS#7 message in bytes.\r
   @param[in]  TrustedCert  Pointer to a trusted/root certificate encoded in DER, which\r
   @param[in]  P7Data       Pointer to the PKCS#7 message to verify.\r
   @param[in]  P7Length     Length of the PKCS#7 message in bytes.\r
   @param[in]  TrustedCert  Pointer to a trusted/root certificate encoded in DER, which\r

diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
index 87f3b93fb9ac77f0bdb12133d543c66ec4422fcc..f864efcd562e2b2413314a4d5802075d44fbdb3f 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
@@ -1,6 +1,11 @@
 ## @file\r
 #  Cryptographic Library Instance for DXE_RUNTIME_DRIVER\r
 #\r
 ## @file\r
 #  Cryptographic Library Instance for DXE_RUNTIME_DRIVER\r
 #\r

+#  Caution: This module requires additional review when modified.\r
+#  This library will have external input - signature.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r

 #  Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r

diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
index f7bccc4379ae260d4bf84143081a08094c0ec182..ac3494a20cc7740ff3f900510e81a5b4051bd468 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
@@ -10,6 +10,11 @@
 #  5) DhGenerateParameter\r
 #  6) DhGenerateKey\r
 #\r
 #  5) DhGenerateParameter\r
 #  6) DhGenerateKey\r
 #\r

+#  Caution: This module requires additional review when modified.\r
+#  This library will have external input - signature.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r

 #  Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r

diff --git a/MdeModulePkg/Universal/CapsulePei/CapsulePei.inf b/MdeModulePkg/Universal/CapsulePei/CapsulePei.inf
index 8f9ebfb8ba4a8d25cff185828a63bcf0e77367ce..8f96d9ec8a91805708e521fc5398c5e22a79f005 100644 (file)
--- a/MdeModulePkg/Universal/CapsulePei/CapsulePei.inf
+++ b/MdeModulePkg/Universal/CapsulePei/CapsulePei.inf
@@ -3,7 +3,12 @@
 #\r
 # Capsule update module supports EFI and UEFI.\r
 #\r
 #\r
 # Capsule update module supports EFI and UEFI.\r
 #\r

-# Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>\r
+#  Caution: This module requires additional review when modified.\r
+#  This driver will have external input - capsule image.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r
+# Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r

 #\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions\r
 #\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions\r

diff --git a/MdeModulePkg/Universal/CapsulePei/CapsuleX64.inf b/MdeModulePkg/Universal/CapsulePei/CapsuleX64.inf
index 6242cc69d0680aaf2ffcc72a5fe69168d075b5ea..1c155ce5f3a5afc397c6c7572e9946b7827fc485 100644 (file)
--- a/MdeModulePkg/Universal/CapsulePei/CapsuleX64.inf
+++ b/MdeModulePkg/Universal/CapsulePei/CapsuleX64.inf
@@ -4,6 +4,11 @@
 # The X64 entrypoint to process capsule in long mode.\r
 # This module is built as X64.\r
 #\r
 # The X64 entrypoint to process capsule in long mode.\r
 # This module is built as X64.\r
 #\r

+#  Caution: This module requires additional review when modified.\r
+#  This driver will have external input - capsule image.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r

 # Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #\r
 # This program and the accompanying materials\r
 # Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #\r
 # This program and the accompanying materials\r

diff --git a/MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c b/MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c
index 32b7dccec80982e80e5c8c1cd049c3f495689f50..7ed15ef2afd9987ad44ec5663c2a662035639393 100644 (file)
--- a/MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c
+++ b/MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c
@@ -1,6 +1,14 @@
 /** @file\r
   The logic to process capsule.\r
 \r
 /** @file\r
   The logic to process capsule.\r
 \r

+  Caution: This module requires additional review when modified.\r
+  This driver will have external input - capsule image.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  CapsuleDataCoalesce() will do basic validation before coalesce capsule data\r
+  into memory.\r
+\r

 Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r


@@ -792,6 +800,10 @@ BuildCapsuleDescriptors (
                    |    PrivateDataDesc 0      |\r
       MemBase ---->+---------------------------+<----- BlockList\r
 \r
                    |    PrivateDataDesc 0      |\r
       MemBase ---->+---------------------------+<----- BlockList\r
 \r

+  Caution: This function may receive untrusted input.\r
+  The capsule data is external input, so this routine will do basic validation before\r
+  coalesce capsule data into memory.\r
+\r

   @param PeiServices        General purpose services available to every PEIM.\r
   @param BlockListBuffer    Point to the buffer of Capsule Descriptor Variables.\r
   @param MemoryBase         Pointer to the base of a block of memory that we can walk\r
   @param PeiServices        General purpose services available to every PEIM.\r
   @param BlockListBuffer    Point to the buffer of Capsule Descriptor Variables.\r
   @param MemoryBase         Pointer to the base of a block of memory that we can walk\r

diff --git a/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c b/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c
index 6caec01a6cef0043eacee5a478799378de44b791..a3910041a3daaffdf0bfe245bf7d49de8904bec3 100644 (file)
--- a/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c
+++ b/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c
@@ -2,7 +2,18 @@
   Decode a hard disk partitioned with the GPT scheme in the UEFI 2.0\r
   specification.\r
 \r
   Decode a hard disk partitioned with the GPT scheme in the UEFI 2.0\r
   specification.\r
 \r

-Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>\r
+  Caution: This file requires additional review when modified.\r
+  This driver will have external input - disk partition.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  PartitionInstallGptChildHandles() routine will read disk partition content and\r
+  do basic validation before PartitionInstallChildHandle().\r
+\r
+  PartitionValidGptTable(), PartitionCheckGptEntry() routine will accept disk\r
+  partition content and validate the GPT table and GPT entry.\r
+\r
+Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -19,6 +30,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 /**\r
   Install child handles if the Handle supports GPT partition structure.\r
 \r
 /**\r
   Install child handles if the Handle supports GPT partition structure.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  The GPT partition table header is external input, so this routine\r
+  will do basic validation for GPT partition table header before return.\r
+\r

   @param[in]  BlockIo     Parent BlockIo interface.\r
   @param[in]  DiskIo      Disk Io protocol.\r
   @param[in]  Lba         The starting Lba of the Partition Table\r
   @param[in]  BlockIo     Parent BlockIo interface.\r
   @param[in]  DiskIo      Disk Io protocol.\r
   @param[in]  Lba         The starting Lba of the Partition Table\r


@@ -77,8 +92,11 @@ PartitionRestoreGptTable (
 \r
 \r
 /**\r
 \r
 \r
 /**\r

-  Restore Partition Table to its alternate place.\r
-  (Primary -> Backup or Backup -> Primary)\r
+  This routine will check GPT partition entry and return entry status.\r
+\r
+  Caution: This function may receive untrusted input.\r
+  The GPT partition entry is external input, so this routine\r
+  will do basic validation for GPT partition entry and report status.\r

 \r
   @param[in]    PartHeader    Partition table header structure\r
   @param[in]    PartEntry     The partition entry array\r
 \r
   @param[in]    PartHeader    Partition table header structure\r
   @param[in]    PartEntry     The partition entry array\r


@@ -158,6 +176,11 @@ PartitionSetCrc (
 /**\r
   Install child handles if the Handle supports GPT partition structure.\r
 \r
 /**\r
   Install child handles if the Handle supports GPT partition structure.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  The GPT partition table is external input, so this routine\r
+  will do basic validation for GPT partition table before install\r
+  child handle for each GPT partition.\r
+\r

   @param[in]  This       Calling context.\r
   @param[in]  Handle     Parent Handle.\r
   @param[in]  DiskIo     Parent DiskIo interface.\r
   @param[in]  This       Calling context.\r
   @param[in]  Handle     Parent Handle.\r
   @param[in]  DiskIo     Parent DiskIo interface.\r


@@ -411,7 +434,11 @@ Done:
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Install child handles if the Handle supports GPT partition structure.\r
+  This routine will read GPT partition table header and return it.\r
+\r
+  Caution: This function may receive untrusted input.\r
+  The GPT partition table header is external input, so this routine\r
+  will do basic validation for GPT partition table header before return.\r

 \r
   @param[in]  BlockIo     Parent BlockIo interface.\r
   @param[in]  DiskIo      Disk Io protocol.\r
 \r
   @param[in]  BlockIo     Parent BlockIo interface.\r
   @param[in]  DiskIo      Disk Io protocol.\r


@@ -640,8 +667,11 @@ Done:
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Restore Partition Table to its alternate place.\r
-  (Primary -> Backup or Backup -> Primary)\r
+  This routine will check GPT partition entry and return entry status.\r
+\r
+  Caution: This function may receive untrusted input.\r
+  The GPT partition entry is external input, so this routine\r
+  will do basic validation for GPT partition entry and report status.\r

 \r
   @param[in]    PartHeader    Partition table header structure\r
   @param[in]    PartEntry     The partition entry array\r
 \r
   @param[in]    PartHeader    Partition table header structure\r
   @param[in]    PartEntry     The partition entry array\r

diff --git a/MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf b/MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
index cf5090fb7ce08bebd4be67b58b26e313b6cf7141..aac20a13b1bea3478e929dc18b92a30271cbb09d 100644 (file)
--- a/MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
+++ b/MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
@@ -6,8 +6,13 @@
 #  the bytes from Start to End of the Parent Block I/O device.\r
 #  The partition of physical BlockIo device supported is one of legacy MBR, GPT,\r
 #  and "El Torito" partitions.\r
 #  the bytes from Start to End of the Parent Block I/O device.\r
 #  The partition of physical BlockIo device supported is one of legacy MBR, GPT,\r
 #  and "El Torito" partitions.\r

-#  \r
-#  Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>\r
+#\r
+#  Caution: This module requires additional review when modified.\r
+#  This driver will have external input - disk partition.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r
+#  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r

 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  which accompanies this distribution.  The full text of the license may be found at\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  which accompanies this distribution.  The full text of the license may be found at\r

diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
index e44f04c799308e6c298d682a78775e02034edd38..71089bbb0de6afda69c87e9657edba70841a88f1 100644 (file)
--- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
+++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
@@ -2,6 +2,19 @@
   Base PE/COFF loader supports loading any PE32/PE32+ or TE image, but\r
   only supports relocating IA32, x64, IPF, and EBC images.\r
 \r
   Base PE/COFF loader supports loading any PE32/PE32+ or TE image, but\r
   only supports relocating IA32, x64, IPF, and EBC images.\r
 \r

+  Caution: This file requires additional review when modified.\r
+  This library will have external input - PE/COFF image.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  The basic guideline is that caller need provide ImageContext->ImageRead () with the\r
+  necessary data range check, to make sure when this library reads PE/COFF image, the\r
+  PE image buffer is always in valid range.\r
+  This library will also do some additional check for PE header fields.\r
+\r
+  PeCoffLoaderGetPeHeader() routine will do basic check for PE/COFF header.\r
+  PeCoffLoaderGetImageInfo() routine will do basic check for whole PE/COFF image.\r
+\r

   Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
   Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>\r
   This program and the accompanying materials\r
   Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
   Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>\r
   This program and the accompanying materials\r


@@ -48,7 +61,10 @@ PeCoffLoaderGetPeHeaderMagicValue (
 \r
 /**\r
   Retrieves the PE or TE Header from a PE/COFF or TE image. \r
 \r
 /**\r
   Retrieves the PE or TE Header from a PE/COFF or TE image. \r

-  Also done many checks in PE image to make sure PE image DosHeader, PeOptionHeader, \r
+\r
+  Caution: This function may receive untrusted input.\r
+  PE/COFF image is external input, so this routine will \r
+  also done many checks in PE image to make sure PE image DosHeader, PeOptionHeader, \r

   SizeOfHeader, Section Data Region and Security Data Region be in PE image range. \r
 \r
   @param  ImageContext    The context of the image being loaded.\r
   SizeOfHeader, Section Data Region and Security Data Region be in PE image range. \r
 \r
   @param  ImageContext    The context of the image being loaded.\r


@@ -376,7 +392,9 @@ PeCoffLoaderGetPeHeader (
   The ImageRead and Handle fields of ImageContext structure must be valid prior \r
   to invoking this service.\r
 \r
   The ImageRead and Handle fields of ImageContext structure must be valid prior \r
   to invoking this service.\r
 \r

-  Also done many checks in PE image to make sure PE image DosHeader, PeOptionHeader, \r
+  Caution: This function may receive untrusted input.\r
+  PE/COFF image is external input, so this routine will \r
+  also done many checks in PE image to make sure PE image DosHeader, PeOptionHeader, \r

   SizeOfHeader, Section Data Region and Security Data Region be in PE image range. \r
 \r
   @param  ImageContext              The pointer to the image context structure that describes the PE/COFF\r
   SizeOfHeader, Section Data Region and Security Data Region be in PE image range. \r
 \r
   @param  ImageContext              The pointer to the image context structure that describes the PE/COFF\r

diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf b/MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
index 45fdc2196d4d0c76b7ee1944a33013458b094bc7..470ae884069caf7594540ae4f11e1877f30c454a 100644 (file)
--- a/MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+++ b/MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
@@ -4,7 +4,12 @@
 #  The IA32 version library support loading IA32, X64 and EBC PE/COFF images.\r
 #  The X64 version library support loading IA32, X64 and EBC PE/COFF images.\r
 #\r
 #  The IA32 version library support loading IA32, X64 and EBC PE/COFF images.\r
 #  The X64 version library support loading IA32, X64 and EBC PE/COFF images.\r
 #\r

-#  Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>\r
+#  Caution: This module requires additional review when modified.\r
+#  This library will have external input - PE/COFF image.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r
+#  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r

 #  Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>\r
 #\r
 #  This program and the accompanying materials\r
 #  Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>\r
 #\r
 #  This program and the accompanying materials\r

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 2a54296134b5835ed7f5645f58fd79fbf6d9a189..dff4bd037141b11d3f41eb067b3759994575f609 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -1,6 +1,17 @@
 /** @file\r
   Implement image verification services for secure boot service in UEFI2.3.1.\r
 \r
 /** @file\r
   Implement image verification services for secure boot service in UEFI2.3.1.\r
 \r

+  Caution: This file requires additional review when modified.\r
+  This library will have external input - PE/COFF image.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content\r
+  read is within the image buffer.\r
+\r
+  DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept\r
+  untrusted PE/COFF image and validate its data structure within this image buffer before use.\r
+\r

 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r


@@ -14,15 +25,23 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 #include "DxeImageVerificationLib.h"\r
 \r
 \r
 #include "DxeImageVerificationLib.h"\r
 \r

+//\r
+// Caution: This is used by a function which may receive untrusted input.\r
+// These global variables hold PE/COFF image data, and they should be validated before use.\r
+//\r

 EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION mNtHeader;\r
 EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION mNtHeader;\r

-UINTN                               mImageSize;\r

 UINT32                              mPeCoffHeaderOffset;\r
 UINT32                              mPeCoffHeaderOffset;\r

-UINT8                               mImageDigest[MAX_DIGEST_SIZE];\r
-UINTN                               mImageDigestSize;\r

 EFI_IMAGE_DATA_DIRECTORY            *mSecDataDir      = NULL;\r
 EFI_IMAGE_DATA_DIRECTORY            *mSecDataDir      = NULL;\r

-UINT8                               *mImageBase       = NULL;\r

 EFI_GUID                            mCertType;\r
 \r
 EFI_GUID                            mCertType;\r
 \r

+//\r
+// Information on current PE/COFF image\r
+//\r
+UINTN                               mImageSize;\r
+UINT8                               *mImageBase       = NULL;\r
+UINT8                               mImageDigest[MAX_DIGEST_SIZE];\r
+UINTN                               mImageDigestSize;\r
+\r

 //\r
 // Notify string for authorization UI.\r
 //\r
 //\r
 // Notify string for authorization UI.\r
 //\r


@@ -57,6 +76,10 @@ HASH_TABLE mHash[] = {
 /**\r
   Reads contents of a PE/COFF image in memory buffer.\r
 \r
 /**\r
   Reads contents of a PE/COFF image in memory buffer.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  PE/COFF image is external input, so this function will make sure the PE/COFF image content\r
+  read is within the image buffer.\r
+\r

   @param  FileHandle      Pointer to the file handle to read the PE/COFF image.\r
   @param  FileOffset      Offset into the PE/COFF image to begin the read operation.\r
   @param  ReadSize        On input, the size in bytes of the requested read operation.  \r
   @param  FileHandle      Pointer to the file handle to read the PE/COFF image.\r
   @param  FileOffset      Offset into the PE/COFF image to begin the read operation.\r
   @param  ReadSize        On input, the size in bytes of the requested read operation.  \r


@@ -229,6 +252,10 @@ GetImageType (
   Caculate hash of Pe/Coff image based on the authenticode image hashing in\r
   PE/COFF Specification 8.0 Appendix A\r
 \r
   Caculate hash of Pe/Coff image based on the authenticode image hashing in\r
   PE/COFF Specification 8.0 Appendix A\r
 \r

+  Caution: This function may receive untrusted input.\r
+  PE/COFF image is external input, so this function will validate its data structure\r
+  within this image buffer before use.\r
+\r

   @param[in]    HashAlg   Hash algorithm type.\r
 \r
   @retval TRUE            Successfully hash image.\r
   @param[in]    HashAlg   Hash algorithm type.\r
 \r
   @retval TRUE            Successfully hash image.\r


@@ -550,6 +577,10 @@ Done:
   Pe/Coff image based on the authenticode image hashing in PE/COFF Specification\r
   8.0 Appendix A\r
 \r
   Pe/Coff image based on the authenticode image hashing in PE/COFF Specification\r
   8.0 Appendix A\r
 \r

+  Caution: This function may receive untrusted input.\r
+  PE/COFF image is external input, so this function will validate its data structure\r
+  within this image buffer before use.\r
+\r

   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.\r
   @retval EFI_SUCCESS                 Hash successfully.\r
 \r
   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.\r
   @retval EFI_SUCCESS                 Hash successfully.\r
 \r


@@ -1184,6 +1215,10 @@ Done:
           If no,\r
             Error out\r
 \r
           If no,\r
             Error out\r
 \r

+  Caution: This function may receive untrusted input.\r
+  PE/COFF image is external input, so this function will validate its data structure\r
+  within this image buffer before use.\r
+\r

   @param[in]    AuthenticationStatus\r
                            This is the authentication status returned from the security\r
                            measurement services for the input file.\r
   @param[in]    AuthenticationStatus\r
                            This is the authentication status returned from the security\r
                            measurement services for the input file.\r

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
index 860d64ba83fec2f771eee10c0dbd8d6799f1ea72..e561a648a1986177ad635f583e2f1f7ed0f2f58f 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
@@ -2,6 +2,11 @@
 #  The library instance provides security service of image verification.\r
 #  Image verification Library module supports UEFI2.3.1\r
 #\r
 #  The library instance provides security service of image verification.\r
 #  Image verification Library module supports UEFI2.3.1\r
 #\r

+#  Caution: This module requires additional review when modified.\r
+#  This library will have external input - PE/COFF image.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r

 # Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r

diff --git a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
index 515b0a5d7231ef5cd43505d5f4c9f1ee346df60b..5316e5b785ce3126eb8eca7b2e85ad0c22d69023 100644 (file)
--- a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
+++ b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
@@ -2,6 +2,12 @@
 \r
   Execute pending TPM requests from OS or BIOS and Lock TPM.\r
 \r
 \r
   Execute pending TPM requests from OS or BIOS and Lock TPM.\r
 \r

+  Caution: This module requires additional review when modified.\r
+  This driver will have external input - variable.\r
+  This external input must be validated carefully to avoid security issue.\r
+\r
+  ExecutePendingTpmRequest() will receive untrusted input and do validation.\r
+\r

 Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r


@@ -882,6 +888,10 @@ UserConfirm (
 /**\r
   Check and execute the requested physical presence command.\r
 \r
 /**\r
   Check and execute the requested physical presence command.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  TcgPpData variable is external input, so this function will validate\r
+  its data structure to be valid value.\r
+\r

   @param[in] TcgProtocol          EFI TCG Protocol instance. \r
   @param[in] TcgPpData            Point to the physical presence NV variable.\r
 \r
   @param[in] TcgProtocol          EFI TCG Protocol instance. \r
   @param[in] TcgPpData            Point to the physical presence NV variable.\r
 \r

diff --git a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf
index 3a163bc912e130ae9c1a462183a0860857801138..0a197fd31c35e15edfbd469c7d3fc5ddc416eb93 100644 (file)
--- a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf
+++ b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf
@@ -2,7 +2,11 @@
 # TCG physical presence library instance. This library will lock\r
 # TPM after executing TPM request.\r
 #\r
 # TCG physical presence library instance. This library will lock\r
 # TPM after executing TPM request.\r
 #\r

-# Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>\r
+#  Caution: This module requires additional review when modified.\r
+#  This driver will have external input - variable.\r
+#  This external input must be validated carefully to avoid security issue.\r
+#\r
+# Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r

 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # which accompanies this distribution. The full text of the license may be found at\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # which accompanies this distribution. The full text of the license may be found at\r

diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
index bbd38b74eda74e235fb20e83cb8d321dc64c519f..d4616fa3c96fc6be48daac82379e48f996898b17 100644 (file)
--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
@@ -1,6 +1,20 @@
 /** @file\r
   The library instance provides security service of TPM measure boot.  \r
 \r
 /** @file\r
   The library instance provides security service of TPM measure boot.  \r
 \r

+  Caution: This file requires additional review when modified.\r
+  This library will have external input - PE/COFF image and GPT partition.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  DxeTpmMeasureBootLibImageRead() function will make sure the PE/COFF image content\r
+  read is within the image buffer.\r
+\r
+  TcgMeasurePeImage() function will accept untrusted PE/COFF image and validate its\r
+  data structure within this image buffer before use.\r
+\r
+  TcgMeasureGptTable() function will receive untrusted GPT partition table, and parse\r
+  partition data carefully.\r
+\r

 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r


@@ -42,6 +56,10 @@ UINTN                             mImageSize;
 /**\r
   Reads contents of a PE/COFF image in memory buffer.\r
 \r
 /**\r
   Reads contents of a PE/COFF image in memory buffer.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  PE/COFF image is external input, so this function will make sure the PE/COFF image content\r
+  read is within the image buffer.\r
+\r

   @param  FileHandle      Pointer to the file handle to read the PE/COFF image.\r
   @param  FileOffset      Offset into the PE/COFF image to begin the read operation.\r
   @param  ReadSize        On input, the size in bytes of the requested read operation.  \r
   @param  FileHandle      Pointer to the file handle to read the PE/COFF image.\r
   @param  FileOffset      Offset into the PE/COFF image to begin the read operation.\r
   @param  ReadSize        On input, the size in bytes of the requested read operation.  \r


@@ -86,6 +104,9 @@ DxeTpmMeasureBootLibImageRead (
 /**\r
   Measure GPT table data into TPM log.\r
 \r
 /**\r
   Measure GPT table data into TPM log.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  The GPT partition table is external input, so this function should parse partition data carefully.\r
+\r

   @param TcgProtocol             Pointer to the located TCG protocol instance.\r
   @param GptHandle               Handle that GPT partition was installed.\r
 \r
   @param TcgProtocol             Pointer to the located TCG protocol instance.\r
   @param GptHandle               Handle that GPT partition was installed.\r
 \r


@@ -247,6 +268,10 @@ TcgMeasureGptTable (
   Measure PE image into TPM log based on the authenticode image hashing in\r
   PE/COFF Specification 8.0 Appendix A.\r
 \r
   Measure PE image into TPM log based on the authenticode image hashing in\r
   PE/COFF Specification 8.0 Appendix A.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  PE/COFF image is external input, so this function will validate its data structure\r
+  within this image buffer before use.\r
+\r

   @param[in] TcgProtocol    Pointer to the located TCG protocol instance.\r
   @param[in] ImageAddress   Start address of image buffer.\r
   @param[in] ImageSize      Image size\r
   @param[in] TcgProtocol    Pointer to the located TCG protocol instance.\r
   @param[in] ImageAddress   Start address of image buffer.\r
   @param[in] ImageSize      Image size\r

diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
index bf83bf10221bb832280ae7dc18e58270e3ce1618..44d27a0887748e30d52573e08690c73209bb79fb 100644 (file)
--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
@@ -1,7 +1,12 @@
 ## @file\r
 #  The library instance provides security service of TPM measure boot.\r
 #\r
 ## @file\r
 #  The library instance provides security service of TPM measure boot.\r
 #\r

-# Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>\r
+#  Caution: This module requires additional review when modified.\r
+#  This library will have external input - PE/COFF image and GPT partition.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r
+# Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r

 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # which accompanies this distribution. The full text of the license may be found at\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # which accompanies this distribution. The full text of the license may be found at\r

diff --git a/SecurityPkg/Tcg/TcgSmm/TcgSmm.c b/SecurityPkg/Tcg/TcgSmm/TcgSmm.c
index dd6d89f695fc7310a1279a90c8f75210f364f234..6fa383d46d640f0cd5fab86073b8948087815daa 100644 (file)
--- a/SecurityPkg/Tcg/TcgSmm/TcgSmm.c
+++ b/SecurityPkg/Tcg/TcgSmm/TcgSmm.c
@@ -2,6 +2,12 @@
   It updates TPM items in ACPI table and registers SMI callback\r
   functions for physical presence and ClearMemory.\r
 \r
   It updates TPM items in ACPI table and registers SMI callback\r
   functions for physical presence and ClearMemory.\r
 \r

+  Caution: This module requires additional review when modified.\r
+  This driver will have external input - variable and ACPINvs data in SMM mode.\r
+  This external input must be validated carefully to avoid security issue.\r
+\r
+  PhysicalPresenceCallback() and MemoryClearCallback() will receive untrusted input and do some check.\r
+\r

 Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r


@@ -21,6 +27,10 @@ TCG_NVS                    *mTcgNvs;
 /**\r
   Software SMI callback for TPM physical presence which is called from ACPI method.\r
 \r
 /**\r
   Software SMI callback for TPM physical presence which is called from ACPI method.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  Variable and ACPINvs are external input, so this function will validate\r
+  its data structure to be valid value.\r
+\r

   @param[in]      DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().\r
   @param[in]      Context         Points to an optional handler context which was specified when the\r
                                   handler was registered.\r
   @param[in]      DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().\r
   @param[in]      Context         Points to an optional handler context which was specified when the\r
                                   handler was registered.\r


@@ -161,6 +171,10 @@ PhysicalPresenceCallback (
 /**\r
   Software SMI callback for MemoryClear which is called from ACPI method.\r
 \r
 /**\r
   Software SMI callback for MemoryClear which is called from ACPI method.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  Variable and ACPINvs are external input, so this function will validate\r
+  its data structure to be valid value.\r
+\r

   @param[in]      DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().\r
   @param[in]      Context         Points to an optional handler context which was specified when the\r
                                   handler was registered.\r
   @param[in]      DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().\r
   @param[in]      Context         Points to an optional handler context which was specified when the\r
                                   handler was registered.\r

diff --git a/SecurityPkg/Tcg/TcgSmm/TcgSmm.inf b/SecurityPkg/Tcg/TcgSmm/TcgSmm.inf
index 9e5751a430d9ba026e3c8f87f595b5f9fb498b8d..9c023cfa90da1e429d122f9381d7cecc47428056 100644 (file)
--- a/SecurityPkg/Tcg/TcgSmm/TcgSmm.inf
+++ b/SecurityPkg/Tcg/TcgSmm/TcgSmm.inf
@@ -3,6 +3,10 @@
 #  registers SMI callback functions for physical presence and \r
 #  MemoryClear to handle the requests from ACPI method.\r
 #\r
 #  registers SMI callback functions for physical presence and \r
 #  MemoryClear to handle the requests from ACPI method.\r
 #\r

+#  Caution: This module requires additional review when modified.\r
+#  This driver will have external input - variable and ACPINvs data in SMM mode.\r
+#  This external input must be validated carefully to avoid security issue.\r
+#\r

 # Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
index a3b620f02a94bcffd2c77d4d08e6b6e4f57f22ca..d6df32affc27f9ca8c3de4753b37a539741db300 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
@@ -2,6 +2,19 @@
   Implement authentication services for the authenticated variable\r
   service in UEFI2.2.\r
 \r
   Implement authentication services for the authenticated variable\r
   service in UEFI2.2.\r
 \r

+  Caution: This module requires additional review when modified.\r
+  This driver will have external input - variable data. It may be input in SMM mode.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+  Variable attribute should also be checked to avoid authentication bypass.\r
+\r
+  ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do\r
+  variable authentication.\r
+\r
+  VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.\r
+  They will do basic validation for authentication data structure, then call crypto library\r
+  to verify the signature.\r
+\r

 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r


@@ -502,6 +515,12 @@ AddPubKeyInStore (
   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.\r
   Follow the steps in UEFI2.2.\r
 \r
   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.\r
   Follow the steps in UEFI2.2.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+\r

   @param[in]      Data                    Pointer to data with AuthInfo.\r
   @param[in]      DataSize                Size of Data.\r
   @param[in]      PubKey                  Public key used for verification.\r
   @param[in]      Data                    Pointer to data with AuthInfo.\r
   @param[in]      DataSize                Size of Data.\r
   @param[in]      PubKey                  Public key used for verification.\r


@@ -852,6 +871,13 @@ CheckSignatureListFormat(
 /**\r
   Process variable with platform key for verification.\r
 \r
 /**\r
   Process variable with platform key for verification.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+  This function will check attribute carefully to avoid authentication bypass.\r
+\r

   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r
   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r


@@ -961,6 +987,13 @@ ProcessVarWithPk (
 /**\r
   Process variable with key exchange key for verification.\r
 \r
 /**\r
   Process variable with key exchange key for verification.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+  This function will check attribute carefully to avoid authentication bypass.\r
+\r

   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r
   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r


@@ -1039,6 +1072,13 @@ ProcessVarWithKek (
 /**\r
   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
 \r
 /**\r
   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+  This function will check attribute carefully to avoid authentication bypass.\r
+\r

   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
 \r
   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
 \r


@@ -1806,6 +1846,12 @@ InsertCertsToDb (
 /**\r
   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
 \r
 /**\r
   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+\r

   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r
   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
index 4419c9174436721f7bd77f576e9b62512018aaa4..7eb2a9d23c62c0cfe002feec577322c2bff9f9db 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
@@ -76,6 +76,13 @@ typedef struct {
 /**\r
   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
 \r
 /**\r
   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+  This function will check attribute carefully to avoid authentication bypass.\r
+\r

   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
 \r
   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
 \r


@@ -162,6 +169,13 @@ CheckSignatureListFormat(
 /**\r
   Process variable with platform key for verification.\r
 \r
 /**\r
   Process variable with platform key for verification.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+  This function will check attribute carefully to avoid authentication bypass.\r
+\r

   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r
   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r


@@ -191,6 +205,13 @@ ProcessVarWithPk (
 /**\r
   Process variable with key exchange key for verification.\r
 \r
 /**\r
   Process variable with key exchange key for verification.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+  This function will check attribute carefully to avoid authentication bypass.\r
+\r

   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r
   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r


@@ -257,6 +278,12 @@ CompareTimeStamp (
 /**\r
   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
 \r
 /**\r
   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+\r

   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r
   @param[in]  VariableName                Name of Variable to be found.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
   @param[in]  Data                        Data pointer.\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
index 49358de0138cafe3f33a39a8cf9f822e09709710..fe7d5b93522fbc4299fa5680c9d54202f911e199 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
@@ -2,6 +2,20 @@
   The common variable operation routines shared by DXE_RUNTIME variable\r
   module and DXE_SMM variable module.\r
 \r
   The common variable operation routines shared by DXE_RUNTIME variable\r
   module and DXE_SMM variable module.\r
 \r

+  Caution: This module requires additional review when modified.\r
+  This driver will have external input - variable data. They may be input in SMM mode.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  VariableServiceGetNextVariableName () and VariableServiceQueryVariableInfo() are external API.\r
+  They need check input parameter.\r
+\r
+  VariableServiceGetVariable() and VariableServiceSetVariable() are external API\r
+  to receive datasize and data buffer. The size should be checked carefully.\r
+\r
+  VariableServiceSetVariable() should also check authenticate data to avoid buffer overflow,\r
+  integer overflow. It should also check attribute to avoid authentication bypass.\r
+\r

 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r


@@ -1945,6 +1959,10 @@ IsHwErrRecVariable (
 \r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r
 \r
 \r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize is external input.\r
+  This function will do basic validation, before parse the data.\r
+\r

   @param VariableName               Name of Variable to be found.\r
   @param VendorGuid                 Variable vendor GUID.\r
   @param Attributes                 Attribute value of the variable found.\r
   @param VariableName               Name of Variable to be found.\r
   @param VendorGuid                 Variable vendor GUID.\r
   @param Attributes                 Attribute value of the variable found.\r


@@ -2022,6 +2040,9 @@ Done:
 \r
   This code Finds the Next available variable.\r
 \r
 \r
   This code Finds the Next available variable.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode. This function will do basic validation, before parse the data.\r
+\r

   @param VariableNameSize           Size of the variable name.\r
   @param VariableName               Pointer to variable name.\r
   @param VendorGuid                 Variable Vendor Guid.\r
   @param VariableNameSize           Size of the variable name.\r
   @param VariableName               Pointer to variable name.\r
   @param VendorGuid                 Variable Vendor Guid.\r


@@ -2167,6 +2188,13 @@ Done:
 \r
   This code sets variable in storage blocks (Volatile or Non-Volatile).\r
 \r
 \r
   This code sets variable in storage blocks (Volatile or Non-Volatile).\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+  This function will check attribute carefully to avoid authentication bypass.\r
+\r

   @param VariableName                     Name of Variable to be found.\r
   @param VendorGuid                       Variable vendor GUID.\r
   @param Attributes                       Attribute value of the variable found\r
   @param VariableName                     Name of Variable to be found.\r
   @param VendorGuid                       Variable vendor GUID.\r
   @param Attributes                       Attribute value of the variable found\r


@@ -2336,6 +2364,9 @@ VariableServiceSetVariable (
 \r
   This code returns information about the EFI variables.\r
 \r
 \r
   This code returns information about the EFI variables.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode. This function will do basic validation, before parse the data.\r
+\r

   @param Attributes                     Attributes bitmask to specify the type of variables\r
                                         on which to return information.\r
   @param MaximumVariableStorageSize     Pointer to the maximum size of the storage space available\r
   @param Attributes                     Attributes bitmask to specify the type of variables\r
                                         on which to return information.\r
   @param MaximumVariableStorageSize     Pointer to the maximum size of the storage space available\r


@@ -2497,6 +2528,9 @@ VariableServiceQueryVariableInfo (
 /**\r
   This function reclaims variable storage if free size is below the threshold.\r
 \r
 /**\r
   This function reclaims variable storage if free size is below the threshold.\r
 \r

+  Caution: This function may be invoked at SMM runtime.\r
+  Care must be taken to make sure not security issue at runtime.\r
+\r

 **/\r
 VOID\r
 ReclaimForOS(\r
 **/\r
 VOID\r
 ReclaimForOS(\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
index bfb2f4e8f70f84341439febba4aa9fffe87cd93d..14a0744a57ed39cdc174c253f5ef0839b0bf225e 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
@@ -402,6 +402,10 @@ GetFvbInfoByAddress (
 \r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r
 \r
 \r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+\r

   @param VariableName               Name of Variable to be found.\r
   @param VendorGuid                 Variable vendor GUID.\r
   @param Attributes                 Attribute value of the variable found.\r
   @param VariableName               Name of Variable to be found.\r
   @param VendorGuid                 Variable vendor GUID.\r
   @param Attributes                 Attribute value of the variable found.\r


@@ -429,6 +433,9 @@ VariableServiceGetVariable (
 \r
   This code Finds the Next available variable.\r
 \r
 \r
   This code Finds the Next available variable.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode. This function will do basic validation, before parse the data.\r
+\r

   @param VariableNameSize           Size of the variable name.\r
   @param VariableName               Pointer to variable name.\r
   @param VendorGuid                 Variable Vendor Guid.\r
   @param VariableNameSize           Size of the variable name.\r
   @param VariableName               Pointer to variable name.\r
   @param VendorGuid                 Variable Vendor Guid.\r


@@ -451,6 +458,13 @@ VariableServiceGetNextVariableName (
 \r
   This code sets variable in storage blocks (Volatile or Non-Volatile).\r
 \r
 \r
   This code sets variable in storage blocks (Volatile or Non-Volatile).\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode, and datasize and data are external input.\r
+  This function will do basic validation, before parse the data.\r
+  This function will parse the authentication carefully to avoid security issues, like\r
+  buffer overflow, integer overflow.\r
+  This function will check attribute carefully to avoid authentication bypass.\r
+\r

   @param VariableName                     Name of Variable to be found.\r
   @param VendorGuid                       Variable vendor GUID.\r
   @param Attributes                       Attribute value of the variable found\r
   @param VariableName                     Name of Variable to be found.\r
   @param VendorGuid                       Variable vendor GUID.\r
   @param Attributes                       Attribute value of the variable found\r


@@ -479,6 +493,9 @@ VariableServiceSetVariable (
 \r
   This code returns information about the EFI variables.\r
 \r
 \r
   This code returns information about the EFI variables.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This function may be invoked in SMM mode. This function will do basic validation, before parse the data.\r
+\r

   @param Attributes                     Attributes bitmask to specify the type of variables\r
                                         on which to return information.\r
   @param MaximumVariableStorageSize     Pointer to the maximum size of the storage space available\r
   @param Attributes                     Attributes bitmask to specify the type of variables\r
                                         on which to return information.\r
   @param MaximumVariableStorageSize     Pointer to the maximum size of the storage space available\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf
index 6765efbf2ba3ef0c2c7e21a4e5baefac0af04b7f..ab676f456a3d60dc9118d417b559970769c53f27 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf
@@ -1,6 +1,11 @@
 ## @file\r
 #  Component description file for Authenticated Variable module.\r
 #\r
 ## @file\r
 #  Component description file for Authenticated Variable module.\r
 #\r

+#  Caution: This module requires additional review when modified.\r
+#  This driver will have external input - variable data.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r

 # Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c
index 197735e3992b27f2ad45a9cc36aa77b06686b4cb..944394bef16533dd621923d5dd15b09210aa0116 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c
@@ -3,7 +3,18 @@
   implements an SMI handler to communicate with the DXE runtime driver \r
   to provide variable services.\r
 \r
   implements an SMI handler to communicate with the DXE runtime driver \r
   to provide variable services.\r
 \r

-Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>\r
+  Caution: This module requires additional review when modified.\r
+  This driver will have external input - variable data and communicate buffer in SMM mode.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  SmmVariableHandler() will receive untrusted input and do basic validation.\r
+\r
+  Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(), \r
+  VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(), \r
+  SmmVariableGetStatistics() should also do validation based on its own knowledge.\r
+\r
+Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 which accompanies this distribution.  The full text of the license may be found at \r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 which accompanies this distribution.  The full text of the license may be found at \r


@@ -241,6 +252,9 @@ GetFvbCountAndBuffer (
 /**\r
   Get the variable statistics information from the information buffer pointed by gVariableInfo.\r
 \r
 /**\r
   Get the variable statistics information from the information buffer pointed by gVariableInfo.\r
 \r

+  Caution: This function may be invoked at SMM runtime.\r
+  InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.\r
+\r

   @param[in, out]  InfoEntry    A pointer to the buffer of variable information entry.\r
                                 On input, point to the variable information returned last time. if \r
                                 InfoEntry->VendorGuid is zero, return the first information.\r
   @param[in, out]  InfoEntry    A pointer to the buffer of variable information entry.\r
                                 On input, point to the variable information returned last time. if \r
                                 InfoEntry->VendorGuid is zero, return the first information.\r


@@ -338,6 +352,12 @@ SmmVariableGetStatistics (
 \r
   This SMI handler provides services for the variable wrapper driver.\r
 \r
 \r
   This SMI handler provides services for the variable wrapper driver.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  This variable data and communicate buffer are external input, so this function will do basic validation.\r
+  Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(), \r
+  VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(), \r
+  SmmVariableGetStatistics() should also do validation based on its own knowledge.\r
+\r

   @param[in]     DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().\r
   @param[in]     RegisterContext Points to an optional handler context which was specified when the\r
                                  handler was registered.\r
   @param[in]     DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().\r
   @param[in]     RegisterContext Points to an optional handler context which was specified when the\r
                                  handler was registered.\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf
index cb9787df9c06e951bc6a9f29ed82300ff2293ca9..a6343dbbbdef0f500060fa70e75bf406b809e170 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf
@@ -9,6 +9,11 @@
 #  SMM Runtime DXE module would install variable arch protocol and variable\r
 #  write arch protocol based on SMM variable module.\r
 #\r
 #  SMM Runtime DXE module would install variable arch protocol and variable\r
 #  write arch protocol based on SMM variable module.\r
 #\r

+#  Caution: This module requires additional review when modified.\r
+#  This driver will have external input - variable data and communicate buffer in SMM mode.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r

 # Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
index 212dd5110292d7b3de5f527d1fe95b42409b3bbb..8aa568111f930776cd46c6a16303281b2d2b16c3 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
@@ -3,7 +3,17 @@
   and volatile storage space and install variable architecture protocol\r
   based on SMM variable module.\r
 \r
   and volatile storage space and install variable architecture protocol\r
   based on SMM variable module.\r
 \r

-Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>\r
+  Caution: This module requires additional review when modified.\r
+  This driver will have external input - variable data.\r
+  This external input must be validated carefully to avoid security issue like\r
+  buffer overflow, integer overflow.\r
+\r
+  RuntimeServiceGetVariable() and RuntimeServiceSetVariable() are external API\r
+  to receive data buffer. The size should be checked carefully.\r
+\r
+  InitCommunicateBuffer() is really function to check the variable data size.\r
+\r
+Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 which accompanies this distribution.  The full text of the license may be found at \r
 This program and the accompanying materials \r
 are licensed and made available under the terms and conditions of the BSD License \r
 which accompanies this distribution.  The full text of the license may be found at \r


@@ -50,6 +60,9 @@ UINTN                            mVariableBufferSize;
   The communicate size is: SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE +\r
   DataSize.\r
 \r
   The communicate size is: SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE +\r
   DataSize.\r
 \r

+  Caution: This function may receive untrusted input.\r
+  The data size external input, so this function will validate it carefully to avoid buffer overflow.\r
+\r

   @param[out]      DataPtr          Points to the data in the communicate buffer.\r
   @param[in]       DataSize         The data size to send to SMM.\r
   @param[in]       Function         The function number to initialize the communicate header.\r
   @param[out]      DataPtr          Points to the data in the communicate buffer.\r
   @param[in]       DataSize         The data size to send to SMM.\r
   @param[in]       Function         The function number to initialize the communicate header.\r


@@ -119,6 +132,9 @@ SendCommunicateBuffer (
 /**\r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r
 \r
 /**\r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r
 \r

+  Caution: This function may receive untrusted input.\r
+  The data size is external input, so this function will validate it carefully to avoid buffer overflow.\r
+\r

   @param[in]      VariableName       Name of Variable to be found.\r
   @param[in]      VendorGuid         Variable vendor GUID.\r
   @param[out]     Attributes         Attribute value of the variable found.\r
   @param[in]      VariableName       Name of Variable to be found.\r
   @param[in]      VendorGuid         Variable vendor GUID.\r
   @param[out]     Attributes         Attribute value of the variable found.\r


@@ -264,6 +280,9 @@ RuntimeServiceGetNextVariableName (
 /**\r
   This code sets variable in storage blocks (Volatile or Non-Volatile).\r
 \r
 /**\r
   This code sets variable in storage blocks (Volatile or Non-Volatile).\r
 \r

+  Caution: This function may receive untrusted input.\r
+  The data size and data are external input, so this function will validate it carefully to avoid buffer overflow.\r
+\r

   @param[in] VariableName                 Name of Variable to be found.\r
   @param[in] VendorGuid                   Variable vendor GUID.\r
   @param[in] Attributes                   Attribute value of the variable found\r
   @param[in] VariableName                 Name of Variable to be found.\r
   @param[in] VendorGuid                   Variable vendor GUID.\r
   @param[in] Attributes                   Attribute value of the variable found\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.inf
index c1fb6acae84c5a08fbd093868f630ec8ac876dc9..3842f0105d71a1d3e7631070342a54ab909f09f5 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.inf
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.inf
@@ -5,7 +5,12 @@
 #  installs variable arch protocol and variable write arch protocol and works \r
 #  with SMM variable module together. \r
 #\r
 #  installs variable arch protocol and variable write arch protocol and works \r
 #  with SMM variable module together. \r
 #\r

-# Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>\r
+#  Caution: This module requires additional review when modified.\r
+#  This driver will have external input - variable data.\r
+#  This external input must be validated carefully to avoid security issue like\r
+#  buffer overflow, integer overflow.\r
+#\r
+# Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r

 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # which accompanies this distribution. The full text of the license may be found at\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # which accompanies this distribution. The full text of the license may be found at\r