efi-boot-shim.git/pe.c, branch rolling

pe: read_header(): allow skipping SecDir content validation

2025-02-26T00:40:54+00:00

When we're parsing the PE header of shim itself from the Loaded Image object, the signatures aren't present, but the Certificate Table entry in the Data Directory has not been cleared, so it'll fail verification. We know when we're doing that, so this patch makes that test optional. Signed-off-by: Peter Jones

Move memory attribute support to its own file.

2025-02-24T20:24:24+00:00

This moves the EFI Memory Attribute Protocol helper functions to their own file, since they're not related to PE things. Signed-off-by: Peter Jones

get_mem_attrs(): ensure an error code is set on failure

2025-02-24T20:24:24+00:00

This changes get_mem_attrs() to return EFI_UNSUPPORTED if LibLocateProtocol() does not return an error but does give us a NULL pointer. Signed-off-by: Peter Jones

Don't print full screen error dialog from handle_image() when called in_protocol

2025-02-11T15:43:37+00:00

This isn't desirable when GRUB has control of the screen, and would mess its content up. Signed-off-by: Mate Kukri

pe: Enhance debug report for update_mem_attrs

2025-02-04T16:54:43+00:00

When memory attributes cannot be updated due to misalignment with 4K or when the size is 0, the debug printout lacks sufficient clarity to indicate the issue. To enhance troubleshooting, it is crucial to generate an error log that explicitly states the failure to execute the expected action. This error log will be visible even when the debug level log is not enabled, thereby significantly reducing debugging time. Signed-off-by: Jianyong Wu

Print errors when setting/clearing memory attrs

2023-12-05T18:20:00+00:00

When working on issues with the memory attributes API, shim does not currently display any errors which are returned from the API itself. This adds those error messages. Resolves #575 Signed-off-by: Peter Jones

CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system

2023-12-05T18:20:00+00:00

In verify_sbat_section(), we do some math on data that comes from the binary being verified - in this case, we add 1 to the size of the ".sbat" section as reported in the section header, which is then used as the input to the size of an allocation. The original value is then used for a size in a memcpy(), which means there's an out-of-bounds write in the overflow case. Due to the type of the variable being size_t, but the type in the section header being uint32_t, this is only plausibly accomplished on 32-bit systems. This patch makes the arithmetic use a checked add operation to avoid overflow. Additionally, it adds a check in verify_buffer_sbat() to guarantee that the data is within the binary. It's not currently known if this is actually exploitable on such systems; the memory layout on a particular machine may further mitigate this scenario. Resolves: CVE-2023-40548 Reported-by: gkirkpatrick@google.com Signed-off-by: Peter Jones

Correctly free memory allocated in handle_image()

2023-07-19T20:07:02+00:00

Currently pe's handle_image() function has two related issues, which are a memory leak in most error paths and an incorrect FreePool() call in some error paths. This patch adds the correct FreePages() calls to most error paths, and switches the FreePool() call to match them. [commit message re-written to be more informative by pjones] Signed-off-by: Dennis Tseng

Split pe.c up even more.

2023-06-23T21:13:13+00:00

This moves the parts of pe.c that *don't* depend on Cryptlib into pe-relocate.c, so we can write test cases for them without having to make a second openssl build without EFI support. Signed-off-by: Peter Jones

pe: only process RelocDir->Size of reloc section

2023-06-21T17:45:57+00:00

Previously processing full padding-aligned Section->Misc.VirtualSize relied on padding reloc entries being inserted by GenFw, which is not required by spec. This changes it to only process the amount referenced by Size, rather than VirtualSize which may be bigger than the data present. Signed-off-by: Mike Beaton