Mirocom/EDK2-fork
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

NetworkPkg/IScsiDxe:Fix for Remote Memory Exposure in ISCSI bz4206

Browse Source 
Used SafeUint32Add to calculate and validate OutTransferLength with
boundary check in IScsiOnR2TRcvd to avoid integer overflow

Signed-off-by: Madhavan <madavtechy@gmail.com>
This commit is contained in:
Madhavan
2025-03-14 14:15:13 -04:00
committed by mergify[bot]
parent 2fe270a361
commit 17cdc512f0
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
NetworkPkg/IScsiDxe/IScsiProto.c
View File

@@ -1,7 +1,7 @@
/** @file /** @file
The implementation of iSCSI protocol based on RFC3720. The implementation of iSCSI protocol based on RFC3720.
Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR> Copyright (c) 2004 - 2025, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent SPDX-License-Identifier: BSD-2-Clause-Patent
**/ **/
@@ -2682,6 +2682,7 @@ IScsiOnR2TRcvd (
EFI_STATUS Status; EFI_STATUS Status;
ISCSI_XFER_CONTEXT *XferContext; ISCSI_XFER_CONTEXT *XferContext;
UINT8 *Data; UINT8 *Data;
UINT32 TransferLength;
R2THdr = (ISCSI_READY_TO_TRANSFER *)NetbufGetByte (Pdu, 0, NULL); R2THdr = (ISCSI_READY_TO_TRANSFER *)NetbufGetByte (Pdu, 0, NULL);
if (R2THdr == NULL) { if (R2THdr == NULL) {
@@ -2712,7 +2713,12 @@ IScsiOnR2TRcvd (
XferContext->Offset = R2THdr->BufferOffset; XferContext->Offset = R2THdr->BufferOffset;
XferContext->DesiredLength = R2THdr->DesiredDataTransferLength; XferContext->DesiredLength = R2THdr->DesiredDataTransferLength;
if (((XferContext->Offset + XferContext->DesiredLength) > Packet->OutTransferLength) || Status = SafeUint32Add (XferContext->Offset, XferContext->DesiredLength, &TransferLength);
if (EFI_ERROR (Status)) {
return EFI_PROTOCOL_ERROR;
}
if ((TransferLength > Packet->OutTransferLength) ||
(XferContext->DesiredLength > Tcb->Conn->Session->MaxBurstLength) (XferContext->DesiredLength > Tcb->Conn->Session->MaxBurstLength)
) )
{ {