From bfb8c64cbf6a4604b1a69de8e274cce7f0a678dc Mon Sep 17 00:00:00 2001 From: Hao Wu Date: Tue, 30 Oct 2018 09:11:57 +0800 Subject: [PATCH] MdeModulePkg/UdfDxe: Content check for 'File' in ResolveSymlink() REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1279 The content within 'File' is the output data for ResolveSymlink(). This commit will add checks to ensure the content in 'File' is valid. Otherwise, possible null pointer dereference issue will occur during the subsequent usage of the data returned by ResolveSymlink(). Cc: Ruiyu Ni Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu Reviewed-by: Paulo Alcantara Reviewed-by: Star Zeng Reviewed-by: Leif Lindholm --- .../Disk/UdfDxe/FileSystemOperations.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c index fed3da1fa1..14b1deac92 100644 --- a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c +++ b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c @@ -2145,6 +2145,8 @@ ResolveSymlink ( UINT8 CompressionId; UDF_FILE_INFO PreviousFile; + ZeroMem ((VOID *)File, sizeof (UDF_FILE_INFO)); + // // Symlink files on UDF volumes do not contain so much data other than // Path Components which resolves to real filenames, so it's OK to read in @@ -2288,6 +2290,14 @@ ResolveSymlink ( break; } + // + // Check the content in the file info pointed by File. + // + if ((File->FileEntry == NULL) || (File->FileIdentifierDesc == NULL)) { + Status = EFI_VOLUME_CORRUPTED; + goto Error_Find_File; + } + if (CompareMem ((VOID *)&PreviousFile, (VOID *)Parent, sizeof (UDF_FILE_INFO)) != 0) { CleanupFileInformation (&PreviousFile); @@ -2301,6 +2311,13 @@ ResolveSymlink ( // FreePool (ReadFileInfo.FileData); + // + // Check the content in the resolved file info. + // + if ((File->FileEntry == NULL) || (File->FileIdentifierDesc == NULL)) { + return EFI_VOLUME_CORRUPTED; + } + return EFI_SUCCESS; Error_Find_File: -- 2.39.2