MdePkg: Fix overflow issue in BasePeCoffLib

Flickdm · mergify[bot] · commit c95233b8525c · 2024-09-30T18:12:30.000Z
The RelocDir-&gt;Size is a UINT32 value, and RelocDir-&gt;VirtualAddress is
also a UINT32 value. The current code does not check for overflow when
adding RelocDir-&gt;Size to RelocDir-&gt;VirtualAddress. This patch adds a
check to ensure that the addition does not overflow.

Signed-off-by: Doug Flick &lt;dougflick@microsoft.com&gt;
Authored-by: sriraamx gobichettipalayam &lt;sri..@intel.com&gt;
diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
@@ -1054,7 +1054,7 @@ PeCoffLoaderRelocateImage (
     RelocDir = &Hdr.Te->DataDirectory[0];
   }
 
-  if ((RelocDir != NULL) && (RelocDir->Size > 0)) {
+  if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {
     RelocBase    = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
     RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (
                                                   ImageContext,

Original file line number	Diff line number	Diff line change
`@@ -1054,7 +1054,7 @@ PeCoffLoaderRelocateImage (`
`1054`	`1054`	`RelocDir = &Hdr.Te->DataDirectory[0];`
`1055`	`1055`	`}`
`1056`	`1056`
`1057`		`- if ((RelocDir != NULL) && (RelocDir->Size > 0)) {`
	`1057`	`+ if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {`
`1058`	`1058`	`RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);`
`1059`	`1059`	`RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (`
`1060`	`1060`	`ImageContext,`