Skip to content

Commit

Permalink
IntelFrameworkModulePkg/FwVolDxe: Ensure FfsFileHeader 8 bytes aligned
Browse files Browse the repository at this point in the history
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=864
REF: CVE-2018-3630

To follow PI spec, ensure FfsFileHeader 8 bytes aligned.

Current code only handles (FwVolHeader->ExtHeaderOffset != 0) path,
update code to also handle (FwVolHeader->ExtHeaderOffset == 0) path.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
  • Loading branch information
lzeng14 authored and jwang36 committed Feb 28, 2019
1 parent 9aef515 commit ece4c1d
Showing 1 changed file with 2 additions and 2 deletions.
Expand Up @@ -4,7 +4,7 @@
Layers on top of Firmware Block protocol to produce a file abstraction
of FV based files.
Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions
Expand Down Expand Up @@ -510,10 +510,10 @@ FvCheck (
//
FwVolExtHeader = (EFI_FIRMWARE_VOLUME_EXT_HEADER *) (UINTN) (FvDevice->CachedFv + FvDevice->FwVolHeader->ExtHeaderOffset);
Ptr = (UINT8 *) FwVolExtHeader + FwVolExtHeader->ExtHeaderSize;
Ptr = (UINT8 *) ALIGN_POINTER (Ptr, 8);
} else {
Ptr = (UINT8 *) (UINTN) (FvDevice->CachedFv + FvDevice->FwVolHeader->HeaderLength);
}
Ptr = (UINT8 *) ALIGN_POINTER (Ptr, 8);
TopFvAddress = (UINT8 *) (UINTN) (FvDevice->CachedFv + FvDevice->FwVolHeader->FvLength);

//
Expand Down

0 comments on commit ece4c1d

Please sign in to comment.