Attachment 871411 Details for Bug 1215103

shim commit CVE-2023-40551 from keybase

pe-mz-bound-check-40551.txt (text/plain), 1.27 KB, created by Tseng on 2023-12-18 06:53:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tseng

Created: 2023-12-18 06:53:24 UTC

Size: 1.27 KB

patch

obsolete

>    Signed-off-by: Peter Jones <pjones@redhat.com>
>
>diff --git a/pe-relocate.c b/pe-relocate.c
>index 9c8c5e3..b11fc68 100644
>--- a/pe-relocate.c
>+++ b/pe-relocate.c
>@@ -309,7 +309,7 @@ static int
> image_is_64_bit(EFI_IMAGE_OPTIONAL_HEADER_UNION *PEHdr)
> {
>        /* .Magic is the same offset in all cases */
>-       if (PEHdr->Pe32Plus.OptionalHeader.Magic
>+       if (PEHdr->Pe32.OptionalHeader.Magic
>                        == EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC)
>                return 1;
>        return 0;
>@@ -375,14 +375,34 @@ read_header(void *data, unsigned int datasize,
>        unsigned long HeaderWithoutDataDir, SectionHeaderOffset, OptHeaderSize;
>        unsigned long FileAlignment = 0;
>        UINT16 DllFlags;
>+       size_t dos_sz = 0;
> 
>-       if (datasize < sizeof (PEHdr->Pe32)) {
>+       if (datasize < sizeof (*DosHdr)) {
>                perror(L"Invalid image\n");
>                return EFI_UNSUPPORTED;
>        }
> 
>-       if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE)
>+       if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {
>+               if (DosHdr->e_lfanew < sizeof (*DosHdr) ||
>+                   DosHdr->e_lfanew > datasize - 4) {
>+                       perror(L"Invalid image\n");
>+                       return EFI_UNSUPPORTED;
>+               }
>lines 25-58

Actions: View

Attachments on bug 1215103: 871411 | 871511