From 7501b6bb449f6e4d13e700a65650f9308f54c8c1 Mon Sep 17 00:00:00 2001 From: Jonathan Yong Date: Fri, 16 Apr 2021 09:59:03 +0800 Subject: [PATCH 24/35] mok: fix potential buffer overrun in import_mok_state Fix the case where data_size is 0, so config_template is not implicitly copied like the size calculation above. upstream-status: https://github.com/rhboot/shim/issues/249 Signed-off-by: Jonathan Yong --- mok.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/mok.c b/mok.c index beac0ff6..db18093d 100644 --- a/mok.c +++ b/mok.c @@ -1034,10 +1034,12 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle) config_template.data_size = v->data_size; - CopyMem(p, &config_template, sizeof(config_template)); - p += sizeof(config_template); - CopyMem(p, v->data, v->data_size); - p += v->data_size; + if (v->data && v->data_size) { + CopyMem(p, &config_template, sizeof(config_template)); + p += sizeof(config_template); + CopyMem(p, v->data, v->data_size); + p += v->data_size; + } } if (p) { ZeroMem(&config_template, sizeof(config_template)); -- 2.32.0