LongSoft / UEFITool

UEFI firmware image viewer and editor
BSD 2-Clause "Simplified" License
4.47k stars 632 forks source link

Fix possible while true while parsing FV headers #316

Closed mefff closed 2 years ago

mefff commented 2 years ago

While parsing the EFI_FV_BLOCK_MAP_ENTRY array in the FV header it's possible to get into a while true.

I couldn't get much info about EFI_FV_BLOCK_MAP_ENTRY, don't know why it's there since there is already a size. So another possible solution would be to skip the header all together if we fail to parse the EFI_FV_BLOCK_MAP_ENTRY array.

NikolajSchlej commented 2 years ago

Do you have a file that reproduces this issue?

mefff commented 2 years ago

No, just found it digging into the code

NikolajSchlej commented 2 years ago

That code feels like a broken overflow check done by (ab)using pointer arithmetics. I doubt it ever fired because such an UEFI image would not be bootable (if we can't parse it, UEFI also can not). It's clear that "continue" is not what needs to be done there, instead, if we have a block map so large that it overflows the volume, the whole volume needs to be marked as broken and unparsable. Let's convert this into an issue, and I'll fix it properly later.

NikolajSchlej commented 2 years ago

317