Add comment for modules which have external input.

signed-off-by: jiewen.yao@intel.com
reviewed-by: guo.dong@intel.com
reviewed-by: ting.ye@intel.com
reviewed-by: liming.gao@intel.com
reviewed-by: elvin.li@intel.com



git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13446 6f19259b-4bc3-4df7-8a09-765794883524

6 files changed, 90 insertions, 6 deletions

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 2a5429613..dff4bd037 100644
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -1,6 +1,17 @@
 /** @file

   Implement image verification services for secure boot service in UEFI2.3.1.

 

+  Caution: This file requires additional review when modified.

+  This library will have external input - PE/COFF image.

+  This external input must be validated carefully to avoid security issue like

+  buffer overflow, integer overflow.

+

+  DxeImageVerificationLibImageRead() function will make sure the PE/COFF image content

+  read is within the image buffer.

+

+  DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept

+  untrusted PE/COFF image and validate its data structure within this image buffer before use.

+

 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials

 are licensed and made available under the terms and conditions of the BSD License

@@ -14,16 +25,24 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 

 #include "DxeImageVerificationLib.h"

 

+//

+// Caution: This is used by a function which may receive untrusted input.

+// These global variables hold PE/COFF image data, and they should be validated before use.

+//

 EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION mNtHeader;

-UINTN                               mImageSize;

 UINT32                              mPeCoffHeaderOffset;

-UINT8                               mImageDigest[MAX_DIGEST_SIZE];

-UINTN                               mImageDigestSize;

 EFI_IMAGE_DATA_DIRECTORY            *mSecDataDir      = NULL;

-UINT8                               *mImageBase       = NULL;

 EFI_GUID                            mCertType;

 

 //

+// Information on current PE/COFF image

+//

+UINTN                               mImageSize;

+UINT8                               *mImageBase       = NULL;

+UINT8                               mImageDigest[MAX_DIGEST_SIZE];

+UINTN                               mImageDigestSize;

+

+//

 // Notify string for authorization UI.

 //

 CHAR16  mNotifyString1[MAX_NOTIFY_STRING_LEN] = L"Image verification pass but not found in authorized database!";

@@ -57,6 +76,10 @@ HASH_TABLE mHash[] = {
 /**

   Reads contents of a PE/COFF image in memory buffer.

 

+  Caution: This function may receive untrusted input.

+  PE/COFF image is external input, so this function will make sure the PE/COFF image content

+  read is within the image buffer.

+

   @param  FileHandle      Pointer to the file handle to read the PE/COFF image.

   @param  FileOffset      Offset into the PE/COFF image to begin the read operation.

   @param  ReadSize        On input, the size in bytes of the requested read operation.  

@@ -229,6 +252,10 @@ GetImageType (
   Caculate hash of Pe/Coff image based on the authenticode image hashing in

   PE/COFF Specification 8.0 Appendix A

 

+  Caution: This function may receive untrusted input.

+  PE/COFF image is external input, so this function will validate its data structure

+  within this image buffer before use.

+

   @param[in]    HashAlg   Hash algorithm type.

 

   @retval TRUE            Successfully hash image.

@@ -550,6 +577,10 @@ Done:
   Pe/Coff image based on the authenticode image hashing in PE/COFF Specification

   8.0 Appendix A

 

+  Caution: This function may receive untrusted input.

+  PE/COFF image is external input, so this function will validate its data structure

+  within this image buffer before use.

+

   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.

   @retval EFI_SUCCESS                 Hash successfully.

 

@@ -1184,6 +1215,10 @@ Done:
           If no,

             Error out

 

+  Caution: This function may receive untrusted input.

+  PE/COFF image is external input, so this function will validate its data structure

+  within this image buffer before use.

+

   @param[in]    AuthenticationStatus

                            This is the authentication status returned from the security

                            measurement services for the input file.

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
index 860d64ba8..e561a648a 100644
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
@@ -2,6 +2,11 @@
 #  The library instance provides security service of image verification.

 #  Image verification Library module supports UEFI2.3.1

 #

+#  Caution: This module requires additional review when modified.

+#  This library will have external input - PE/COFF image.

+#  This external input must be validated carefully to avoid security issue like

+#  buffer overflow, integer overflow.

+#

 # Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>

 # This program and the accompanying materials

 # are licensed and made available under the terms and conditions of the BSD License

diff --git a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
index 515b0a5d7..5316e5b78 100644
--- a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
+++ b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.c
@@ -2,6 +2,12 @@
 

   Execute pending TPM requests from OS or BIOS and Lock TPM.

 

+  Caution: This module requires additional review when modified.

+  This driver will have external input - variable.

+  This external input must be validated carefully to avoid security issue.

+

+  ExecutePendingTpmRequest() will receive untrusted input and do validation.

+

 Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials 

 are licensed and made available under the terms and conditions of the BSD License 

@@ -882,6 +888,10 @@ UserConfirm (
 /**

   Check and execute the requested physical presence command.

 

+  Caution: This function may receive untrusted input.

+  TcgPpData variable is external input, so this function will validate

+  its data structure to be valid value.

+

   @param[in] TcgProtocol          EFI TCG Protocol instance. 

   @param[in] TcgPpData            Point to the physical presence NV variable.

 

diff --git a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf
index 3a163bc91..0a197fd31 100644
--- a/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf
+++ b/SecurityPkg/Library/DxeTcgPhysicalPresenceLib/DxeTcgPhysicalPresenceLib.inf
@@ -2,7 +2,11 @@
 # TCG physical presence library instance. This library will lock

 # TPM after executing TPM request.

 #

-# Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>

+#  Caution: This module requires additional review when modified.

+#  This driver will have external input - variable.

+#  This external input must be validated carefully to avoid security issue.

+#

+# Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>

 # This program and the accompanying materials

 # are licensed and made available under the terms and conditions of the BSD License

 # which accompanies this distribution. The full text of the license may be found at

diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
index bbd38b74e..d4616fa3c 100644
--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
@@ -1,6 +1,20 @@
 /** @file

   The library instance provides security service of TPM measure boot.  

 

+  Caution: This file requires additional review when modified.

+  This library will have external input - PE/COFF image and GPT partition.

+  This external input must be validated carefully to avoid security issue like

+  buffer overflow, integer overflow.

+

+  DxeTpmMeasureBootLibImageRead() function will make sure the PE/COFF image content

+  read is within the image buffer.

+

+  TcgMeasurePeImage() function will accept untrusted PE/COFF image and validate its

+  data structure within this image buffer before use.

+

+  TcgMeasureGptTable() function will receive untrusted GPT partition table, and parse

+  partition data carefully.

+

 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials 

 are licensed and made available under the terms and conditions of the BSD License 

@@ -42,6 +56,10 @@ UINTN                             mImageSize;
 /**

   Reads contents of a PE/COFF image in memory buffer.

 

+  Caution: This function may receive untrusted input.

+  PE/COFF image is external input, so this function will make sure the PE/COFF image content

+  read is within the image buffer.

+

   @param  FileHandle      Pointer to the file handle to read the PE/COFF image.

   @param  FileOffset      Offset into the PE/COFF image to begin the read operation.

   @param  ReadSize        On input, the size in bytes of the requested read operation.  

@@ -86,6 +104,9 @@ DxeTpmMeasureBootLibImageRead (
 /**

   Measure GPT table data into TPM log.

 

+  Caution: This function may receive untrusted input.

+  The GPT partition table is external input, so this function should parse partition data carefully.

+

   @param TcgProtocol             Pointer to the located TCG protocol instance.

   @param GptHandle               Handle that GPT partition was installed.

 

@@ -247,6 +268,10 @@ TcgMeasureGptTable (
   Measure PE image into TPM log based on the authenticode image hashing in

   PE/COFF Specification 8.0 Appendix A.

 

+  Caution: This function may receive untrusted input.

+  PE/COFF image is external input, so this function will validate its data structure

+  within this image buffer before use.

+

   @param[in] TcgProtocol    Pointer to the located TCG protocol instance.

   @param[in] ImageAddress   Start address of image buffer.

   @param[in] ImageSize      Image size

diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
index bf83bf102..44d27a088 100644
--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
@@ -1,7 +1,12 @@
 ## @file

 #  The library instance provides security service of TPM measure boot.

 #

-# Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>

+#  Caution: This module requires additional review when modified.

+#  This library will have external input - PE/COFF image and GPT partition.

+#  This external input must be validated carefully to avoid security issue like

+#  buffer overflow, integer overflow.

+#

+# Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>

 # This program and the accompanying materials

 # are licensed and made available under the terms and conditions of the BSD License

 # which accompanies this distribution. The full text of the license may be found at