Fix several issues in BaseCryptLib:

1. Add input length check for several APIs in BaseCryptLib.
2. Add return status check when calling OpensslLib functions
3. Adjust BaseCryptLib API to match description of wrapped OpensslLib API.
4. Update INF file to add missed RuntimeServicesTableLib.
5. Fix return status issue of APIs in CryptX509.c that incorrect when error occurs.

Signed-off-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Dong Guo <guo.dong@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13579 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index d996410201c2ddd35bb33b3c0ab27ad93e015c54..4564d7be6542d959101a7a26d5fc58c442c64907 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -1978,12 +1978,13 @@ DhGenerateKey (
   Computes exchanged common key.\r
 \r
   Given peer's public key, this function computes the exchanged common key, based on its own\r
   Computes exchanged common key.\r
 \r
   Given peer's public key, this function computes the exchanged common key, based on its own\r

-  context including value of prime modulus and random secret exponent. \r
+  context including value of prime modulus and random secret exponent.\r

 \r
   If DhContext is NULL, then return FALSE.\r
   If PeerPublicKey is NULL, then return FALSE.\r
   If KeySize is NULL, then return FALSE.\r
 \r
   If DhContext is NULL, then return FALSE.\r
   If PeerPublicKey is NULL, then return FALSE.\r
   If KeySize is NULL, then return FALSE.\r

-  If KeySize is large enough but Key is NULL, then return FALSE.\r
+  If Key is NULL, then return FALSE.\r
+  If KeySize is not large enough, then return FALSE.\r

   If this interface is not supported, then return FALSE.\r
 \r
   @param[in, out]  DhContext          Pointer to the DH context.\r
   If this interface is not supported, then return FALSE.\r
 \r
   @param[in, out]  DhContext          Pointer to the DH context.\r

diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
index 5bb782927860608e0fb89c4f29d2152e3b308a38..95a76f23fefa7a36a8b103c69832940246926771 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+++ b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
@@ -93,6 +93,7 @@
   BaseLib\r
   BaseMemoryLib\r
   MemoryAllocationLib\r
   BaseLib\r
   BaseMemoryLib\r
   MemoryAllocationLib\r

+  UefiRuntimeServicesTableLib\r

   DebugLib\r
   OpensslLib\r
   IntrinsicLib\r
   DebugLib\r
   OpensslLib\r
   IntrinsicLib\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c
index c8dbb797fa7aeb30523dec90cad2c59c02222e4d..753d79814f724c4619eeb480cbaa555751960084 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c
+++ b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptAes.c
@@ -241,7 +241,11 @@ AesCbcEncrypt (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (AesContext == NULL || Input == NULL || (InputSize % AES_BLOCK_SIZE) != 0 || Ivec == NULL || Output == NULL) {\r
+  if (AesContext == NULL || Input == NULL || (InputSize % AES_BLOCK_SIZE) != 0) {\r
+    return FALSE;\r
+  }\r
+\r
+  if (Ivec == NULL || Output == NULL || InputSize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r


@@ -299,7 +303,11 @@ AesCbcDecrypt (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (AesContext == NULL || Input == NULL || (InputSize % AES_BLOCK_SIZE) != 0 || Ivec == NULL || Output == NULL) {\r
+  if (AesContext == NULL || Input == NULL || (InputSize % AES_BLOCK_SIZE) != 0) {\r
+    return FALSE;\r
+  }\r
+\r
+  if (Ivec == NULL || Output == NULL || InputSize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptArc4.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptArc4.c
index 0e5331c20d0824590092e22b6dcdc4268c783f74..f3c4d31a2d9c1598fd7f295fc187f28fe2bf57ed 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptArc4.c
+++ b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptArc4.c
@@ -115,7 +115,7 @@ Arc4Encrypt (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (Arc4Context == NULL || Input == NULL || Output == NULL) {\r
+  if (Arc4Context == NULL || Input == NULL || Output == NULL || InputSize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r


@@ -161,7 +161,7 @@ Arc4Decrypt (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (Arc4Context == NULL || Input == NULL || Output == NULL) {\r
+  if (Arc4Context == NULL || Input == NULL || Output == NULL || InputSize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdes.c b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdes.c
index f3a1eb7293de8da7c88a5abf16463ad6e46f7d29..f89094a58117b96e02f2ad0dc6abbb1670ba142f 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdes.c
+++ b/CryptoPkg/Library/BaseCryptLib/Cipher/CryptTdes.c
@@ -275,7 +275,11 @@ TdesCbcEncrypt (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (TdesContext == NULL || Input == NULL || (InputSize % TDES_BLOCK_SIZE) != 0 || Ivec == NULL || Output == NULL) {\r
+  if (TdesContext == NULL || Input == NULL || (InputSize % TDES_BLOCK_SIZE) != 0) {\r
+    return FALSE;\r
+  }\r
+\r
+  if (Ivec == NULL || Output == NULL || InputSize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r


@@ -339,7 +343,11 @@ TdesCbcDecrypt (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (TdesContext == NULL || Input == NULL || (InputSize % TDES_BLOCK_SIZE) != 0 || Ivec == NULL || Output == NULL) {\r
+  if (TdesContext == NULL || Input == NULL || (InputSize % TDES_BLOCK_SIZE) != 0) {\r
+    return FALSE;\r
+  }\r
+\r
+  if (Ivec == NULL || Output == NULL || InputSize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c
index 45f7d4977e1bf8c148666f35b2bfd6b7121ee789..693cd322c900483b30544507c14dfb30c2109963 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacMd5.c
@@ -58,7 +58,7 @@ HmacMd5Init (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (HmacMd5Context == NULL) {\r
+  if (HmacMd5Context == NULL || KeySize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
index b183ae562e9390e5c1c1447e9cdfdb49e7ef7cbd..881d26cf8e5fbc7f01a4a9afece9ed01bfe1e6ec 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
+++ b/CryptoPkg/Library/BaseCryptLib/Hmac/CryptHmacSha1.c
@@ -58,7 +58,7 @@ HmacSha1Init (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (HmacSha1Context == NULL) {\r
+  if (HmacSha1Context == NULL || KeySize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/InternalCryptLib.h b/CryptoPkg/Library/BaseCryptLib/InternalCryptLib.h
index b04762691bb1e91090a7296cd7d1002e8a36ed02..55876527144f6228ffcec97ca56e410fd262ca09 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/InternalCryptLib.h
+++ b/CryptoPkg/Library/BaseCryptLib/InternalCryptLib.h
@@ -21,6 +21,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/DebugLib.h>\r
 #include <Library/BaseCryptLib.h>\r
 \r
 #include <Library/DebugLib.h>\r
 #include <Library/BaseCryptLib.h>\r
 \r

+#include "OpenSslSupport.h"\r
+\r

 //\r
 // Environment Setting for OpenSSL-based UEFI Crypto Library.\r
 //\r
 //\r
 // Environment Setting for OpenSSL-based UEFI Crypto Library.\r
 //\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c b/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c
index 319ad59eccfe761f420fd9e75060de1617169ec5..078a960d5848e7084ec7516329da7e1da0508c1b 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pem/CryptPem.c
@@ -86,17 +86,24 @@ RsaGetPrivateKeyFromPem (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  Status = FALSE;\r
-  PemBio = NULL;\r
-\r

   //\r
   // Add possible block-cipher descriptor for PEM data decryption.\r
   // NOTE: Only support most popular ciphers (3DES, AES) for the encrypted PEM.\r
   //\r
   //\r
   // Add possible block-cipher descriptor for PEM data decryption.\r
   // NOTE: Only support most popular ciphers (3DES, AES) for the encrypted PEM.\r
   //\r

-  EVP_add_cipher (EVP_des_ede3_cbc ());\r
-  EVP_add_cipher (EVP_aes_128_cbc ());\r
-  EVP_add_cipher (EVP_aes_192_cbc ());\r
-  EVP_add_cipher (EVP_aes_256_cbc ());\r
+  if (EVP_add_cipher (EVP_des_ede3_cbc ()) == 0) {\r
+    return FALSE;\r
+  }\r
+  if (EVP_add_cipher (EVP_aes_128_cbc ()) == 0) {\r
+    return FALSE;\r
+  }\r
+  if (EVP_add_cipher (EVP_aes_192_cbc ()) == 0) {\r
+    return FALSE;\r
+  }\r
+  if (EVP_add_cipher (EVP_aes_256_cbc ()) == 0) {\r
+    return FALSE;\r
+  }\r
+\r
+  Status = FALSE;\r

 \r
   //\r
   // Read encrypted PEM Data.\r
 \r
   //\r
   // Read encrypted PEM Data.\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c
index 30792d27ca08f6b30eceff3d185448f8d468825f..942b3d103e260e49b942efe2395e8717d6570b2e 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptDh.c
@@ -91,7 +91,7 @@ DhGenerateParameter (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (DhContext == NULL || Prime == NULL) {\r
+  if (DhContext == NULL || Prime == NULL || PrimeLength > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r


@@ -139,12 +139,13 @@ DhSetParameter (
   IN      CONST UINT8  *Prime\r
   )\r
 {\r
   IN      CONST UINT8  *Prime\r
   )\r
 {\r

-  DH  *Dh;\r
+  DH      *Dh;\r
+  BIGNUM  *Bn;\r

 \r
   //\r
   // Check input parameters.\r
   //\r
 \r
   //\r
   // Check input parameters.\r
   //\r

-  if (DhContext == NULL || Prime == NULL) {\r
+  if (DhContext == NULL || Prime == NULL || PrimeLength > INT_MAX) {\r

     return FALSE;\r
   }\r
   \r
     return FALSE;\r
   }\r
   \r


@@ -152,14 +153,46 @@ DhSetParameter (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

+  Bn = NULL;\r
+\r

   Dh = (DH *) DhContext;\r
   Dh = (DH *) DhContext;\r

-  Dh->p = BN_new();\r
-  Dh->g = BN_new();\r
+  Dh->g = NULL;\r
+  Dh->p = BN_new ();\r
+  if (Dh->p == NULL) {\r
+    goto Error;\r
+  }\r
+  \r
+  Dh->g = BN_new ();\r
+  if (Dh->g == NULL) {\r
+    goto Error;\r
+  }\r

 \r
 \r

-  BN_bin2bn (Prime, (UINT32) (PrimeLength / 8), Dh->p);\r
-  BN_set_word (Dh->g, (UINT32) Generator);\r
+  Bn = BN_bin2bn (Prime, (UINT32) (PrimeLength / 8), Dh->p);\r
+  if (Bn == NULL) {\r
+    goto Error;\r
+  }\r
+\r
+  if (BN_set_word (Dh->g, (UINT32) Generator) == 0) {\r
+    goto Error;\r
+  }\r

 \r
   return TRUE;\r
 \r
   return TRUE;\r

+\r
+Error:\r
+\r
+  if (Dh->p != NULL) {\r
+    BN_free (Dh->p);\r
+  }\r
+\r
+  if (Dh->g != NULL) {\r
+    BN_free (Dh->g);\r
+  }\r
+\r
+  if (Bn != NULL) {\r
+    BN_free (Bn);\r
+  }\r
+  \r
+  return FALSE;\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r


@@ -194,6 +227,7 @@ DhGenerateKey (
 {\r
   BOOLEAN RetVal;\r
   DH      *Dh;\r
 {\r
   BOOLEAN RetVal;\r
   DH      *Dh;\r

+  INTN    Size;\r

 \r
   //\r
   // Check input parameters.\r
 \r
   //\r
   // Check input parameters.\r


@@ -207,12 +241,17 @@ DhGenerateKey (
   }\r
   \r
   Dh = (DH *) DhContext;\r
   }\r
   \r
   Dh = (DH *) DhContext;\r

-  *PublicKeySize = 0;\r

 \r
   RetVal = (BOOLEAN) DH_generate_key (DhContext);\r
   if (RetVal) {\r
 \r
   RetVal = (BOOLEAN) DH_generate_key (DhContext);\r
   if (RetVal) {\r

+    Size = BN_num_bytes (Dh->pub_key);\r
+    if ((Size > 0) && (*PublicKeySize < (UINTN) Size)) {\r
+      *PublicKeySize = Size;\r
+      return FALSE;\r
+    }\r
+    \r

     BN_bn2bin (Dh->pub_key, PublicKey);\r
     BN_bn2bin (Dh->pub_key, PublicKey);\r

-    *PublicKeySize  = BN_num_bytes (Dh->pub_key);\r
+    *PublicKeySize = Size;\r

   }\r
 \r
   return RetVal;\r
   }\r
 \r
   return RetVal;\r


@@ -227,7 +266,8 @@ DhGenerateKey (
   If DhContext is NULL, then return FALSE.\r
   If PeerPublicKey is NULL, then return FALSE.\r
   If KeySize is NULL, then return FALSE.\r
   If DhContext is NULL, then return FALSE.\r
   If PeerPublicKey is NULL, then return FALSE.\r
   If KeySize is NULL, then return FALSE.\r

-  If KeySize is large enough but Key is NULL, then return FALSE.\r
+  If Key is NULL, then return FALSE.\r
+  If KeySize is not large enough, then return FALSE.\r

 \r
   @param[in, out]  DhContext          Pointer to the DH context.\r
   @param[in]       PeerPublicKey      Pointer to the peer's public key.\r
 \r
   @param[in, out]  DhContext          Pointer to the DH context.\r
   @param[in]       PeerPublicKey      Pointer to the peer's public key.\r


@@ -252,23 +292,37 @@ DhComputeKey (
   )\r
 {\r
   BIGNUM  *Bn;\r
   )\r
 {\r
   BIGNUM  *Bn;\r

+  INTN    Size;\r

 \r
   //\r
   // Check input parameters.\r
   //\r
 \r
   //\r
   // Check input parameters.\r
   //\r

-  if (DhContext == NULL || PeerPublicKey == NULL || KeySize == NULL) {\r
+  if (DhContext == NULL || PeerPublicKey == NULL || KeySize == NULL || Key == NULL) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  if (Key == NULL && *KeySize != 0) {\r
+  if (PeerPublicKeySize > INT_MAX) {\r

     return FALSE;\r
   }\r
   \r
   Bn = BN_bin2bn (PeerPublicKey, (UINT32) PeerPublicKeySize, NULL);\r
     return FALSE;\r
   }\r
   \r
   Bn = BN_bin2bn (PeerPublicKey, (UINT32) PeerPublicKeySize, NULL);\r

+  if (Bn == NULL) {\r
+    return FALSE;\r
+  }\r

 \r
 \r

-  *KeySize = (BOOLEAN) DH_compute_key (Key, Bn, DhContext);\r
+  Size = DH_compute_key (Key, Bn, DhContext);\r
+  if (Size < 0) {\r
+    BN_free (Bn);\r
+    return FALSE;\r
+  }\r

 \r
 \r

-  BN_free (Bn);\r
+  if (*KeySize < (UINTN) Size) {\r
+    *KeySize = Size;\r
+    BN_free (Bn);\r
+    return FALSE;\r
+  }\r

 \r
 \r

+  *KeySize = Size;\r
+  BN_free (Bn);\r

   return TRUE;\r
 }\r
   return TRUE;\r
 }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
index 11472ebf3b27669186765d4038294352258216dd..25865910f69b072eb9cafce1e0596ee8add26836 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Sign.c
@@ -92,12 +92,21 @@ Pkcs7Sign (
     return Status;\r
   }\r
 \r
     return Status;\r
   }\r
 \r

+  Status = FALSE;\r
+\r

   //\r
   // Register & Initialize necessary digest algorithms and PRNG for PKCS#7 Handling\r
   //\r
   //\r
   // Register & Initialize necessary digest algorithms and PRNG for PKCS#7 Handling\r
   //\r

-  EVP_add_digest (EVP_md5());\r
-  EVP_add_digest (EVP_sha1());\r
-  EVP_add_digest (EVP_sha256());\r
+  if (EVP_add_digest (EVP_md5 ()) == 0) {\r
+    goto _Exit;\r
+  }\r
+  if (EVP_add_digest (EVP_sha1 ()) == 0) {\r
+    goto _Exit;\r
+  }\r
+  if (EVP_add_digest (EVP_sha256 ()) == 0) {\r
+    goto _Exit;\r
+  }\r
+\r

   RandomSeed (NULL, 0);\r
 \r
   //\r
   RandomSeed (NULL, 0);\r
 \r
   //\r


@@ -105,7 +114,6 @@ Pkcs7Sign (
   //\r
   Key = EVP_PKEY_new ();\r
   if (Key == NULL) {\r
   //\r
   Key = EVP_PKEY_new ();\r
   if (Key == NULL) {\r

-    Status = FALSE;\r

     goto _Exit;\r
   }\r
   Key->save_type = EVP_PKEY_RSA;\r
     goto _Exit;\r
   }\r
   Key->save_type = EVP_PKEY_RSA;\r


@@ -129,7 +137,6 @@ Pkcs7Sign (
             PKCS7_BINARY | PKCS7_NOATTR | PKCS7_DETACHED\r
             );\r
   if (Pkcs7 == NULL) {\r
             PKCS7_BINARY | PKCS7_NOATTR | PKCS7_DETACHED\r
             );\r
   if (Pkcs7 == NULL) {\r

-    Status = FALSE;\r

     goto _Exit;\r
   }\r
 \r
     goto _Exit;\r
   }\r
 \r


@@ -138,13 +145,11 @@ Pkcs7Sign (
   //\r
   P7DataSize = i2d_PKCS7 (Pkcs7, NULL);\r
   if (P7DataSize <= 19) {\r
   //\r
   P7DataSize = i2d_PKCS7 (Pkcs7, NULL);\r
   if (P7DataSize <= 19) {\r

-    Status = FALSE;\r

     goto _Exit;\r
   }\r
 \r
   P7Data     = malloc (P7DataSize);\r
   if (P7Data == NULL) {\r
     goto _Exit;\r
   }\r
 \r
   P7Data     = malloc (P7DataSize);\r
   if (P7Data == NULL) {\r

-    Status = FALSE;\r

     goto _Exit;\r
   }\r
 \r
     goto _Exit;\r
   }\r
 \r


@@ -158,7 +163,6 @@ Pkcs7Sign (
   *SignedDataSize = P7DataSize - 19;\r
   *SignedData     = malloc (*SignedDataSize);\r
   if (*SignedData == NULL) {\r
   *SignedDataSize = P7DataSize - 19;\r
   *SignedData     = malloc (*SignedDataSize);\r
   if (*SignedData == NULL) {\r

-    Status = FALSE;\r

     OPENSSL_free (P7Data);\r
     goto _Exit;\r
   }\r
     OPENSSL_free (P7Data);\r
     goto _Exit;\r
   }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
index 24f4c031d58e8c5df40864ca370941d8900f6f8b..2e72f892cb144669859ecce0097d6ef76c6db9d8 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
@@ -485,10 +485,19 @@ Pkcs7Verify (
   //\r
   // Register & Initialize necessary digest algorithms for PKCS#7 Handling\r
   //\r
   //\r
   // Register & Initialize necessary digest algorithms for PKCS#7 Handling\r
   //\r

-  EVP_add_digest (EVP_md5());\r
-  EVP_add_digest (EVP_sha1());\r
-  EVP_add_digest_alias (SN_sha1WithRSAEncryption, SN_sha1WithRSA);\r
-  EVP_add_digest (EVP_sha256());\r
+  if (EVP_add_digest (EVP_md5 ()) == 0) {\r
+    return FALSE;\r
+  }\r
+  if (EVP_add_digest (EVP_sha1 ()) == 0) {\r
+    return FALSE;\r
+  }\r
+  if (EVP_add_digest (EVP_sha256 ()) == 0) {\r
+    return FALSE;\r
+  }\r
+  if (EVP_add_digest_alias (SN_sha1WithRSAEncryption, SN_sha1WithRSA) == 0) {\r
+    return FALSE;\r
+  }\r
+\r

 \r
   Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);\r
   if (!Status) {\r
 \r
   Status = WrapPkcs7Data (P7Data, P7Length, &Wrapped, &SignedData, &SignedDataSize);\r
   if (!Status) {\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c
index d828cb4b3f309b9899482fc819eba6ca1aa74305..76754b4a72f0a2800fe88ae637c63893821b7e19 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaBasic.c
@@ -97,7 +97,7 @@ RsaSetKey (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (RsaContext == NULL) {\r
+  if (RsaContext == NULL || BnSize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r


@@ -121,6 +121,10 @@ RsaSetKey (
       break;\r
     }\r
     RsaKey->n = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->n);\r
       break;\r
     }\r
     RsaKey->n = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->n);\r

+    if (RsaKey->n == NULL) {\r
+      return FALSE;\r
+    }\r
+\r

     break;\r
 \r
   //\r
     break;\r
 \r
   //\r


@@ -135,6 +139,10 @@ RsaSetKey (
       break;\r
     }\r
     RsaKey->e = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->e);\r
       break;\r
     }\r
     RsaKey->e = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->e);\r

+    if (RsaKey->e == NULL) {\r
+      return FALSE;\r
+    }\r
+\r

     break;\r
 \r
   //\r
     break;\r
 \r
   //\r


@@ -149,6 +157,10 @@ RsaSetKey (
       break;\r
     }\r
     RsaKey->d = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->d);\r
       break;\r
     }\r
     RsaKey->d = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->d);\r

+    if (RsaKey->d == NULL) {\r
+      return FALSE;\r
+    }\r
+\r

     break;\r
 \r
   //\r
     break;\r
 \r
   //\r


@@ -163,6 +175,10 @@ RsaSetKey (
       break;\r
     }\r
     RsaKey->p = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->p);\r
       break;\r
     }\r
     RsaKey->p = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->p);\r

+    if (RsaKey->p == NULL) {\r
+      return FALSE;\r
+    }\r
+\r

     break;\r
 \r
   //\r
     break;\r
 \r
   //\r


@@ -177,6 +193,10 @@ RsaSetKey (
       break;\r
     }\r
     RsaKey->q = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->q);\r
       break;\r
     }\r
     RsaKey->q = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->q);\r

+    if (RsaKey->q == NULL) {\r
+      return FALSE;\r
+    }\r
+\r

     break;\r
 \r
   //\r
     break;\r
 \r
   //\r


@@ -191,6 +211,10 @@ RsaSetKey (
       break;\r
     }\r
     RsaKey->dmp1 = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->dmp1);\r
       break;\r
     }\r
     RsaKey->dmp1 = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->dmp1);\r

+    if (RsaKey->dmp1 == NULL) {\r
+      return FALSE;\r
+    }\r
+\r

     break;\r
 \r
   //\r
     break;\r
 \r
   //\r


@@ -205,6 +229,10 @@ RsaSetKey (
       break;\r
     }\r
     RsaKey->dmq1 = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->dmq1);\r
       break;\r
     }\r
     RsaKey->dmq1 = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->dmq1);\r

+    if (RsaKey->dmq1 == NULL) {\r
+      return FALSE;\r
+    }\r
+\r

     break;\r
 \r
   //\r
     break;\r
 \r
   //\r


@@ -219,6 +247,10 @@ RsaSetKey (
       break;\r
     }\r
     RsaKey->iqmp = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->iqmp);\r
       break;\r
     }\r
     RsaKey->iqmp = BN_bin2bn (BigNumber, (UINT32) BnSize, RsaKey->iqmp);\r

+    if (RsaKey->iqmp == NULL) {\r
+      return FALSE;\r
+    }\r
+\r

     break;\r
 \r
   default:\r
     break;\r
 \r
   default:\r


@@ -262,7 +294,7 @@ RsaPkcs1Verify (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (RsaContext == NULL || MessageHash == NULL || Signature == NULL) {\r
+  if (RsaContext == NULL || MessageHash == NULL || Signature == NULL || SigSize > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c
index 67d8826e6c4a706d9db930dc2aeb86f4ebbd8b5b..b4faafa0c350e7db61442efc85d6e58c9d7d616b 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c
@@ -231,22 +231,32 @@ RsaGenerateKey (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (RsaContext == NULL) {\r
+  if (RsaContext == NULL || ModulusLength > INT_MAX || PublicExponentSize > INT_MAX) {\r

     return FALSE;\r
   }\r
   \r
   KeyE = BN_new ();\r
     return FALSE;\r
   }\r
   \r
   KeyE = BN_new ();\r

+  if (KeyE == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
+  RetVal = FALSE;\r
+  \r

   if (PublicExponent == NULL) {\r
   if (PublicExponent == NULL) {\r

-    BN_set_word (KeyE, 0x10001);\r
+    if (BN_set_word (KeyE, 0x10001) == 0) {\r
+      goto _Exit;\r
+    }\r

   } else {\r
   } else {\r

-    BN_bin2bn (PublicExponent, (UINT32) PublicExponentSize, KeyE);\r
+    if (BN_bin2bn (PublicExponent, (UINT32) PublicExponentSize, KeyE) == NULL) {\r
+      goto _Exit;\r
+    }\r

   }\r
 \r
   }\r
 \r

-  RetVal = FALSE;\r

   if (RSA_generate_key_ex ((RSA *) RsaContext, (UINT32) ModulusLength, KeyE, NULL) == 1) {\r
    RetVal = TRUE;\r
   }\r
 \r
   if (RSA_generate_key_ex ((RSA *) RsaContext, (UINT32) ModulusLength, KeyE, NULL) == 1) {\r
    RetVal = TRUE;\r
   }\r
 \r

+_Exit:\r

   BN_free (KeyE);\r
   return RetVal;\r
 }\r
   BN_free (KeyE);\r
   return RetVal;\r
 }\r


@@ -299,18 +309,24 @@ RsaCheckKey (
 /**\r
   Performs the PKCS1-v1_5 encoding methods defined in RSA PKCS #1.\r
 \r
 /**\r
   Performs the PKCS1-v1_5 encoding methods defined in RSA PKCS #1.\r
 \r

-  @param  Message      Message buffer to be encoded.\r
-  @param  MessageSize  Size of message buffer in bytes.\r
-  @param  DigestInfo   Pointer to buffer of digest info for output.\r
+  @param[in]     Message        Message buffer to be encoded.\r
+  @param[in]     MessageSize    Size of message buffer in bytes.\r
+  @param[out]    DigestInfo     Pointer to buffer of digest info for output.\r
+  @param[in,out] DigestInfoSize On input, the size of DigestInfo buffer in bytes.\r
+                                On output, the size of data returned in DigestInfo\r
+                                buffer in bytes.\r

 \r
 \r

-  @return  Size of DigestInfo in bytes.\r
+  @retval TRUE   PKCS1-v1_5 encoding finished successfully.\r
+  @retval FALSE  Any input parameter is invalid.\r
+  @retval FALSE  DigestInfo buffer is not large enough.\r

 \r
 **/  \r
 \r
 **/  \r

-UINTN\r
+BOOLEAN\r

 DigestInfoEncoding (\r
 DigestInfoEncoding (\r

-  IN   CONST UINT8  *Message,\r
-  IN   UINTN        MessageSize,\r
-  OUT  UINT8        *DigestInfo\r
+  IN CONST UINT8  *Message,\r
+  IN       UINTN  MessageSize,\r
+  OUT      UINT8  *DigestInfo,\r
+  IN OUT   UINTN  *DigestInfoSize\r

   )\r
 {\r
   CONST UINT8  *HashDer;\r
   )\r
 {\r
   CONST UINT8  *HashDer;\r


@@ -319,7 +335,7 @@ DigestInfoEncoding (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (Message == NULL || DigestInfo == NULL) {\r
+  if (Message == NULL || DigestInfo == NULL || DigestInfoSize == NULL) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r


@@ -347,10 +363,16 @@ DigestInfoEncoding (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

+  if (*DigestInfoSize < DerSize + MessageSize) {\r
+    *DigestInfoSize = DerSize + MessageSize;\r
+    return FALSE;\r
+  }\r
+\r

   CopyMem (DigestInfo, HashDer, DerSize);\r
   CopyMem (DigestInfo + DerSize, Message, MessageSize);\r
 \r
   CopyMem (DigestInfo, HashDer, DerSize);\r
   CopyMem (DigestInfo + DerSize, Message, MessageSize);\r
 \r

-  return (DerSize + MessageSize);\r
+  *DigestInfoSize = DerSize + MessageSize;\r
+  return TRUE;\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r


@@ -412,21 +434,23 @@ RsaPkcs1Sign (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  Size = DigestInfoEncoding (MessageHash, HashSize, Signature);\r
+  if (!DigestInfoEncoding (MessageHash, HashSize, Signature, SigSize)) {\r
+    return FALSE;\r
+  }\r

 \r
   ReturnVal = RSA_private_encrypt (\r
 \r
   ReturnVal = RSA_private_encrypt (\r

-                (UINT32) Size,\r
+                (UINT32) *SigSize,\r

                 Signature,\r
                 Signature,\r
                 Rsa,\r
                 RSA_PKCS1_PADDING\r
                 );\r
 \r
                 Signature,\r
                 Signature,\r
                 Rsa,\r
                 RSA_PKCS1_PADDING\r
                 );\r
 \r

-  if (ReturnVal < (INTN) Size) {\r
+  if (ReturnVal < (INTN) *SigSize) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  *SigSize = (UINTN)ReturnVal;\r
+  *SigSize = (UINTN) ReturnVal;\r

   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
index f90600473a0db474166522f974d86d951a081b77..f0a5d0ac7fbd931b0fc5a8a35f325e2c511894a2 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
@@ -346,7 +346,6 @@ X509GetSubjectName (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  Status   = FALSE;\r

   X509Cert = NULL;\r
 \r
   //\r
   X509Cert = NULL;\r
 \r
   //\r


@@ -354,13 +353,20 @@ X509GetSubjectName (
   //\r
   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
   if ((X509Cert == NULL) || (!Status)) {\r
   //\r
   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
   if ((X509Cert == NULL) || (!Status)) {\r

+    Status = FALSE;\r

     goto _Exit;\r
   }\r
 \r
     goto _Exit;\r
   }\r
 \r

+  Status = FALSE;\r
+\r

   //\r
   // Retrieve subject name from certificate object.\r
   //\r
   X509Name = X509_get_subject_name (X509Cert);\r
   //\r
   // Retrieve subject name from certificate object.\r
   //\r
   X509Name = X509_get_subject_name (X509Cert);\r

+  if (X509Name == NULL) {\r
+    goto _Exit;\r
+  }\r
+\r

   if (*SubjectSize < (UINTN) X509Name->bytes->length) {\r
     *SubjectSize = (UINTN) X509Name->bytes->length;\r
     goto _Exit;\r
   if (*SubjectSize < (UINTN) X509Name->bytes->length) {\r
     *SubjectSize = (UINTN) X509Name->bytes->length;\r
     goto _Exit;\r


@@ -375,7 +381,9 @@ _Exit:
   //\r
   // Release Resources.\r
   //\r
   //\r
   // Release Resources.\r
   //\r

-  X509_free (X509Cert);\r
+  if (X509Cert != NULL) {\r
+    X509_free (X509Cert);\r
+  }\r

 \r
   return Status;\r
 }\r
 \r
   return Status;\r
 }\r


@@ -415,7 +423,6 @@ RsaGetPublicKeyFromX509 (
     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

-  Status   = FALSE;\r

   Pkey     = NULL;\r
   X509Cert = NULL;\r
 \r
   Pkey     = NULL;\r
   X509Cert = NULL;\r
 \r


@@ -424,9 +431,12 @@ RsaGetPublicKeyFromX509 (
   //\r
   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
   if ((X509Cert == NULL) || (!Status)) {\r
   //\r
   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
   if ((X509Cert == NULL) || (!Status)) {\r

+    Status = FALSE;\r

     goto _Exit;\r
   }\r
 \r
     goto _Exit;\r
   }\r
 \r

+  Status = FALSE;\r
+\r

   //\r
   // Retrieve and check EVP_PKEY data from X509 Certificate.\r
   //\r
   //\r
   // Retrieve and check EVP_PKEY data from X509 Certificate.\r
   //\r


@@ -446,8 +456,13 @@ _Exit:
   //\r
   // Release Resources.\r
   //\r
   //\r
   // Release Resources.\r
   //\r

-  X509_free (X509Cert);\r
-  EVP_PKEY_free (Pkey);\r
+  if (X509Cert != NULL) {\r
+    X509_free (X509Cert);\r
+  }\r
+\r
+  if (Pkey != NULL) {\r
+    EVP_PKEY_free (Pkey);\r
+  }  \r

 \r
   return Status;\r
 }\r
 \r
   return Status;\r
 }\r


@@ -498,15 +513,22 @@ X509VerifyCert (
   //\r
   // Register & Initialize necessary digest algorithms for certificate verification.\r
   //\r
   //\r
   // Register & Initialize necessary digest algorithms for certificate verification.\r
   //\r

-  EVP_add_digest (EVP_md5());\r
-  EVP_add_digest (EVP_sha1());\r
-  EVP_add_digest (EVP_sha256());\r
+  if (EVP_add_digest (EVP_md5 ()) == 0) {\r
+    goto _Exit;\r
+  }\r
+  if (EVP_add_digest (EVP_sha1 ()) == 0) {\r
+    goto _Exit;\r
+  }\r
+  if (EVP_add_digest (EVP_sha256 ()) == 0) {\r
+    goto _Exit;\r
+  }\r

 \r
   //\r
   // Read DER-encoded certificate to be verified and Construct X509 object.\r
   //\r
   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
   if ((X509Cert == NULL) || (!Status)) {\r
 \r
   //\r
   // Read DER-encoded certificate to be verified and Construct X509 object.\r
   //\r
   Status = X509ConstructCertificate (Cert, CertSize, (UINT8 **) &X509Cert);\r
   if ((X509Cert == NULL) || (!Status)) {\r

+    Status = FALSE;\r

     goto _Exit;\r
   }\r
 \r
     goto _Exit;\r
   }\r
 \r


@@ -515,9 +537,12 @@ X509VerifyCert (
   //\r
   Status = X509ConstructCertificate (CACert, CACertSize, (UINT8 **) &X509CACert);\r
   if ((X509CACert == NULL) || (!Status)) {\r
   //\r
   Status = X509ConstructCertificate (CACert, CACertSize, (UINT8 **) &X509CACert);\r
   if ((X509CACert == NULL) || (!Status)) {\r

+    Status = FALSE;\r

     goto _Exit;\r
   }\r
 \r
     goto _Exit;\r
   }\r
 \r

+  Status = FALSE;\r
+\r

   //\r
   // Set up X509 Store for trusted certificate.\r
   //\r
   //\r
   // Set up X509 Store for trusted certificate.\r
   //\r


@@ -546,9 +571,17 @@ _Exit:
   //\r
   // Release Resources.\r
   //\r
   //\r
   // Release Resources.\r
   //\r

-  X509_free (X509Cert);\r
-  X509_free (X509CACert);\r
-  X509_STORE_free (CertStore);\r
+  if (X509Cert != NULL) {\r
+    X509_free (X509Cert);\r
+  }\r
+\r
+  if (X509CACert != NULL) {\r
+    X509_free (X509CACert);\r
+  }\r

 \r
 \r

+  if (CertStore != NULL) {\r
+    X509_STORE_free (CertStore);\r
+  }\r
+  \r

   return Status;\r
 }\r
   return Status;\r
 }\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c
index 4b275951e83e70988a545b2062f6da282954ca66..4a056e89d81baa5d10e69b1af9fa9192d0432725 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c
+++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c
@@ -43,6 +43,10 @@ RandomSeed (
   IN  UINTN         SeedSize\r
   )\r
 {\r
   IN  UINTN         SeedSize\r
   )\r
 {\r

+  if (SeedSize > INT_MAX) {\r
+    return FALSE;\r
+  }\r
+\r

   //\r
   // Seed the pseudorandom number generator with user-supplied value.\r
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.\r
   //\r
   // Seed the pseudorandom number generator with user-supplied value.\r
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.\r


@@ -78,7 +82,7 @@ RandomBytes (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (Output == NULL) {\r
+  if (Output == NULL || Size > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandItc.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandItc.c
index 881141cd087a4ebfc736d82bd278b7766a8d932e..dcc1853f136fb600d44e5676b89433819cd8734a 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandItc.c
+++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandItc.c
@@ -41,6 +41,10 @@ RandomSeed (
 {\r
   CHAR8  DefaultSeed[128];\r
 \r
 {\r
   CHAR8  DefaultSeed[128];\r
 \r

+  if (SeedSize > INT_MAX) {\r
+    return FALSE;\r
+  }\r
+\r

   //\r
   // Seed the pseudorandom number generator with user-supplied value.\r
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.\r
   //\r
   // Seed the pseudorandom number generator with user-supplied value.\r
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.\r


@@ -86,7 +90,7 @@ RandomBytes (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (Output == NULL) {\r
+  if (Output == NULL || Size > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
index bb8783d3546b51a398bbc2b984d39a6fcd6bb637..7259ed50da09ab3f9df017a7bbf2b6f57da121bd 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
+++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
@@ -41,6 +41,10 @@ RandomSeed (
 {\r
   CHAR8  DefaultSeed[128];\r
 \r
 {\r
   CHAR8  DefaultSeed[128];\r
 \r

+  if (SeedSize > INT_MAX) {\r
+    return FALSE;\r
+  }\r
+\r

   //\r
   // Seed the pseudorandom number generator with user-supplied value.\r
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.\r
   //\r
   // Seed the pseudorandom number generator with user-supplied value.\r
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.\r


@@ -86,7 +90,7 @@ RandomBytes (
   //\r
   // Check input parameters.\r
   //\r
   //\r
   // Check input parameters.\r
   //\r

-  if (Output == NULL) {\r
+  if (Output == NULL || Size > INT_MAX) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/BaseCryptLibRuntimeCryptProtocol.inf b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/BaseCryptLibRuntimeCryptProtocol.inf
index 2fb9074755f395eef3c8022255d74466f7ee7794..8bb04e94955e6060804bec7180dafc6fc01485d0 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/BaseCryptLibRuntimeCryptProtocol.inf
+++ b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/BaseCryptLibRuntimeCryptProtocol.inf
@@ -62,6 +62,8 @@
 [LibraryClasses]\r
   BaseLib\r
   DebugLib\r
 [LibraryClasses]\r
   BaseLib\r
   DebugLib\r

+  UefiBootServicesTableLib\r
+  UefiRuntimeLib\r

 \r
 [Guids]\r
   gEfiEventVirtualAddressChangeGuid      ## CONSUMES ## Event\r
 \r
 [Guids]\r
   gEfiEventVirtualAddressChangeGuid      ## CONSUMES ## Event\r

diff --git a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/InternalCryptLib.h b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/InternalCryptLib.h
index 998100dce80228262793c4acc0678da84b233e45..959ad0a0f542dd09717e76e05d789e54dfe6fd5d 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/InternalCryptLib.h
+++ b/CryptoPkg/Library/BaseCryptLibRuntimeCryptProtocol/InternalCryptLib.h
@@ -16,8 +16,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define __INTERNAL_CRYPT_LIB_H__\r
 \r
 #include <Library/BaseLib.h>\r
 #define __INTERNAL_CRYPT_LIB_H__\r
 \r
 #include <Library/BaseLib.h>\r

-#include <Library/BaseMemoryLib.h>\r
-#include <Library/MemoryAllocationLib.h>\r

 #include <Library/DebugLib.h>\r
 #include <Library/BaseCryptLib.h>\r
 \r
 #include <Library/DebugLib.h>\r
 #include <Library/BaseCryptLib.h>\r
 \r