According to the ISO C standard, strchr() is a function. We #define it as
a macro. Unfortunately, our macro evaluates the first argument ("str")
twice. If the expression passed for "str" has side effects, the behavior
may be undefined.
In a later patch in this series, we're going to resurrect "inet_pton.c"
(originally from the StdLib package), which calls strchr() just like that:
  strchr((xdigits = xdigits_l), ch)
  strchr((xdigits = xdigits_u), ch)
To enable this kind of function call, turn strchr() into a function.
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960
CVE: CVE-2019-14553
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
		
	
		
			
				
	
	
		
			474 lines
		
	
	
		
			9.5 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			474 lines
		
	
	
		
			9.5 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
/** @file
 | 
						|
  C Run-Time Libraries (CRT) Wrapper Implementation for OpenSSL-based
 | 
						|
  Cryptographic Library.
 | 
						|
 | 
						|
Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
 | 
						|
SPDX-License-Identifier: BSD-2-Clause-Patent
 | 
						|
 | 
						|
**/
 | 
						|
 | 
						|
#include <CrtLibSupport.h>
 | 
						|
 | 
						|
int errno = 0;
 | 
						|
 | 
						|
FILE  *stderr = NULL;
 | 
						|
FILE  *stdin  = NULL;
 | 
						|
FILE  *stdout = NULL;
 | 
						|
 | 
						|
typedef
 | 
						|
int
 | 
						|
(*SORT_COMPARE)(
 | 
						|
  IN  VOID  *Buffer1,
 | 
						|
  IN  VOID  *Buffer2
 | 
						|
  );
 | 
						|
 | 
						|
//
 | 
						|
// Duplicated from EDKII BaseSortLib for qsort() wrapper
 | 
						|
//
 | 
						|
STATIC
 | 
						|
VOID
 | 
						|
QuickSortWorker (
 | 
						|
  IN OUT    VOID          *BufferToSort,
 | 
						|
  IN CONST  UINTN         Count,
 | 
						|
  IN CONST  UINTN         ElementSize,
 | 
						|
  IN        SORT_COMPARE  CompareFunction,
 | 
						|
  IN        VOID          *Buffer
 | 
						|
  )
 | 
						|
{
 | 
						|
  VOID        *Pivot;
 | 
						|
  UINTN       LoopCount;
 | 
						|
  UINTN       NextSwapLocation;
 | 
						|
 | 
						|
  ASSERT(BufferToSort    != NULL);
 | 
						|
  ASSERT(CompareFunction != NULL);
 | 
						|
  ASSERT(Buffer          != NULL);
 | 
						|
 | 
						|
  if (Count < 2 || ElementSize  < 1) {
 | 
						|
    return;
 | 
						|
  }
 | 
						|
 | 
						|
  NextSwapLocation = 0;
 | 
						|
 | 
						|
  //
 | 
						|
  // Pick a pivot (we choose last element)
 | 
						|
  //
 | 
						|
  Pivot = ((UINT8 *)BufferToSort + ((Count - 1) * ElementSize));
 | 
						|
 | 
						|
  //
 | 
						|
  // Now get the pivot such that all on "left" are below it
 | 
						|
  // and everything "right" are above it
 | 
						|
  //
 | 
						|
  for (LoopCount = 0; LoopCount < Count - 1;  LoopCount++)
 | 
						|
  {
 | 
						|
    //
 | 
						|
    // If the element is less than the pivot
 | 
						|
    //
 | 
						|
    if (CompareFunction ((VOID *)((UINT8 *)BufferToSort + ((LoopCount) * ElementSize)), Pivot) <= 0) {
 | 
						|
      //
 | 
						|
      // Swap
 | 
						|
      //
 | 
						|
      CopyMem (Buffer, (UINT8 *)BufferToSort + (NextSwapLocation * ElementSize), ElementSize);
 | 
						|
      CopyMem ((UINT8 *)BufferToSort + (NextSwapLocation * ElementSize), (UINT8 *)BufferToSort + ((LoopCount) * ElementSize), ElementSize);
 | 
						|
      CopyMem ((UINT8 *)BufferToSort + ((LoopCount) * ElementSize), Buffer, ElementSize);
 | 
						|
 | 
						|
      //
 | 
						|
      // Increment NextSwapLocation
 | 
						|
      //
 | 
						|
      NextSwapLocation++;
 | 
						|
    }
 | 
						|
  }
 | 
						|
  //
 | 
						|
  // Swap pivot to its final position (NextSwapLocation)
 | 
						|
  //
 | 
						|
  CopyMem (Buffer, Pivot, ElementSize);
 | 
						|
  CopyMem (Pivot, (UINT8 *)BufferToSort + (NextSwapLocation * ElementSize), ElementSize);
 | 
						|
  CopyMem ((UINT8 *)BufferToSort + (NextSwapLocation * ElementSize), Buffer, ElementSize);
 | 
						|
 | 
						|
  //
 | 
						|
  // Now recurse on 2 partial lists.  Neither of these will have the 'pivot' element.
 | 
						|
  // IE list is sorted left half, pivot element, sorted right half...
 | 
						|
  //
 | 
						|
  QuickSortWorker (
 | 
						|
    BufferToSort,
 | 
						|
    NextSwapLocation,
 | 
						|
    ElementSize,
 | 
						|
    CompareFunction,
 | 
						|
    Buffer
 | 
						|
    );
 | 
						|
 | 
						|
  QuickSortWorker (
 | 
						|
    (UINT8 *)BufferToSort + (NextSwapLocation + 1) * ElementSize,
 | 
						|
    Count - NextSwapLocation - 1,
 | 
						|
    ElementSize,
 | 
						|
    CompareFunction,
 | 
						|
    Buffer
 | 
						|
    );
 | 
						|
 | 
						|
  return;
 | 
						|
}
 | 
						|
 | 
						|
//---------------------------------------------------------
 | 
						|
// Standard C Run-time Library Interface Wrapper
 | 
						|
//---------------------------------------------------------
 | 
						|
 | 
						|
//
 | 
						|
// -- String Manipulation Routines --
 | 
						|
//
 | 
						|
 | 
						|
char *strchr(const char *str, int ch)
 | 
						|
{
 | 
						|
  return ScanMem8 (str, AsciiStrSize (str), (UINT8)ch);
 | 
						|
}
 | 
						|
 | 
						|
/* Scan a string for the last occurrence of a character */
 | 
						|
char *strrchr (const char *str, int c)
 | 
						|
{
 | 
						|
  char * save;
 | 
						|
 | 
						|
  for (save = NULL; ; ++str) {
 | 
						|
    if (*str == c) {
 | 
						|
      save = (char *)str;
 | 
						|
    }
 | 
						|
    if (*str == 0) {
 | 
						|
      return (save);
 | 
						|
    }
 | 
						|
  }
 | 
						|
}
 | 
						|
 | 
						|
/* Compare first n bytes of string s1 with string s2, ignoring case */
 | 
						|
int strncasecmp (const char *s1, const char *s2, size_t n)
 | 
						|
{
 | 
						|
  int Val;
 | 
						|
 | 
						|
  ASSERT(s1 != NULL);
 | 
						|
  ASSERT(s2 != NULL);
 | 
						|
 | 
						|
  if (n != 0) {
 | 
						|
    do {
 | 
						|
      Val = tolower(*s1) - tolower(*s2);
 | 
						|
      if (Val != 0) {
 | 
						|
        return Val;
 | 
						|
      }
 | 
						|
      ++s1;
 | 
						|
      ++s2;
 | 
						|
      if (*s1 == '\0') {
 | 
						|
        break;
 | 
						|
      }
 | 
						|
    } while (--n != 0);
 | 
						|
  }
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
/* Read formatted data from a string */
 | 
						|
int sscanf (const char *buffer, const char *format, ...)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // Null sscanf() function implementation to satisfy the linker, since
 | 
						|
  // no direct functionality logic dependency in present UEFI cases.
 | 
						|
  //
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
/* Maps errnum to an error-message string */
 | 
						|
char * strerror (int errnum)
 | 
						|
{
 | 
						|
  return NULL;
 | 
						|
}
 | 
						|
 | 
						|
/* Computes the length of the maximum initial segment of the string pointed to by s1
 | 
						|
   which consists entirely of characters from the string pointed to by s2. */
 | 
						|
size_t strspn (const char *s1 , const char *s2)
 | 
						|
{
 | 
						|
  UINT8   Map[32];
 | 
						|
  UINT32  Index;
 | 
						|
  size_t  Count;
 | 
						|
 | 
						|
  for (Index = 0; Index < 32; Index++) {
 | 
						|
    Map[Index] = 0;
 | 
						|
  }
 | 
						|
 | 
						|
  while (*s2) {
 | 
						|
    Map[*s2 >> 3] |= (1 << (*s2 & 7));
 | 
						|
    s2++;
 | 
						|
  }
 | 
						|
 | 
						|
  if (*s1) {
 | 
						|
    Count = 0;
 | 
						|
    while (Map[*s1 >> 3] & (1 << (*s1 & 7))) {
 | 
						|
      Count++;
 | 
						|
      s1++;
 | 
						|
    }
 | 
						|
 | 
						|
    return Count;
 | 
						|
  }
 | 
						|
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
/* Computes the length of the maximum initial segment of the string pointed to by s1
 | 
						|
   which consists entirely of characters not from the string pointed to by s2. */
 | 
						|
size_t strcspn (const char *s1, const char *s2)
 | 
						|
{
 | 
						|
  UINT8  Map[32];
 | 
						|
  UINT32 Index;
 | 
						|
  size_t Count;
 | 
						|
 | 
						|
  for (Index = 0; Index < 32; Index++) {
 | 
						|
    Map[Index] = 0;
 | 
						|
  }
 | 
						|
 | 
						|
  while (*s2) {
 | 
						|
    Map[*s2 >> 3] |= (1 << (*s2 & 7));
 | 
						|
    s2++;
 | 
						|
  }
 | 
						|
 | 
						|
  Map[0] |= 1;
 | 
						|
 | 
						|
  Count   = 0;
 | 
						|
  while (!(Map[*s1 >> 3] & (1 << (*s1 & 7)))) {
 | 
						|
    Count ++;
 | 
						|
    s1++;
 | 
						|
  }
 | 
						|
 | 
						|
  return Count;
 | 
						|
}
 | 
						|
 | 
						|
//
 | 
						|
// -- Character Classification Routines --
 | 
						|
//
 | 
						|
 | 
						|
/* Determines if a particular character is a decimal-digit character */
 | 
						|
int isdigit (int c)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // <digit> ::= [0-9]
 | 
						|
  //
 | 
						|
  return (('0' <= (c)) && ((c) <= '9'));
 | 
						|
}
 | 
						|
 | 
						|
/* Determine if an integer represents character that is a hex digit */
 | 
						|
int isxdigit (int c)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // <hexdigit> ::= [0-9] | [a-f] | [A-F]
 | 
						|
  //
 | 
						|
  return ((('0' <= (c)) && ((c) <= '9')) ||
 | 
						|
          (('a' <= (c)) && ((c) <= 'f')) ||
 | 
						|
          (('A' <= (c)) && ((c) <= 'F')));
 | 
						|
}
 | 
						|
 | 
						|
/* Determines if a particular character represents a space character */
 | 
						|
int isspace (int c)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // <space> ::= [ ]
 | 
						|
  //
 | 
						|
  return ((c) == ' ');
 | 
						|
}
 | 
						|
 | 
						|
/* Determine if a particular character is an alphanumeric character */
 | 
						|
int isalnum (int c)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // <alnum> ::= [0-9] | [a-z] | [A-Z]
 | 
						|
  //
 | 
						|
  return ((('0' <= (c)) && ((c) <= '9')) ||
 | 
						|
          (('a' <= (c)) && ((c) <= 'z')) ||
 | 
						|
          (('A' <= (c)) && ((c) <= 'Z')));
 | 
						|
}
 | 
						|
 | 
						|
/* Determines if a particular character is in upper case */
 | 
						|
int isupper (int c)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // <uppercase letter> := [A-Z]
 | 
						|
  //
 | 
						|
  return (('A' <= (c)) && ((c) <= 'Z'));
 | 
						|
}
 | 
						|
 | 
						|
//
 | 
						|
// -- Data Conversion Routines --
 | 
						|
//
 | 
						|
 | 
						|
/* Convert strings to a long-integer value */
 | 
						|
long strtol (const char *nptr, char **endptr, int base)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // Null strtol() function implementation to satisfy the linker, since there is
 | 
						|
  // no direct functionality logic dependency in present UEFI cases.
 | 
						|
  //
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
/* Convert strings to an unsigned long-integer value */
 | 
						|
unsigned long strtoul (const char *nptr, char **endptr, int base)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // Null strtoul() function implementation to satisfy the linker, since there is
 | 
						|
  // no direct functionality logic dependency in present UEFI cases.
 | 
						|
  //
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
/* Convert character to lowercase */
 | 
						|
int tolower (int c)
 | 
						|
{
 | 
						|
  if (('A' <= (c)) && ((c) <= 'Z')) {
 | 
						|
    return (c - ('A' - 'a'));
 | 
						|
  }
 | 
						|
  return (c);
 | 
						|
}
 | 
						|
 | 
						|
//
 | 
						|
// -- Searching and Sorting Routines --
 | 
						|
//
 | 
						|
 | 
						|
/* Performs a quick sort */
 | 
						|
void qsort (void *base, size_t num, size_t width, int (*compare)(const void *, const void *))
 | 
						|
{
 | 
						|
  VOID  *Buffer;
 | 
						|
 | 
						|
  ASSERT (base    != NULL);
 | 
						|
  ASSERT (compare != NULL);
 | 
						|
 | 
						|
  //
 | 
						|
  // Use CRT-style malloc to cover BS and RT memory allocation.
 | 
						|
  //
 | 
						|
  Buffer = malloc (width);
 | 
						|
  ASSERT (Buffer != NULL);
 | 
						|
 | 
						|
  //
 | 
						|
  // Re-use PerformQuickSort() function Implementation in EDKII BaseSortLib.
 | 
						|
  //
 | 
						|
  QuickSortWorker (base, (UINTN)num, (UINTN)width, (SORT_COMPARE)compare, Buffer);
 | 
						|
 | 
						|
  free (Buffer);
 | 
						|
  return;
 | 
						|
}
 | 
						|
 | 
						|
//
 | 
						|
// -- Process and Environment Control Routines --
 | 
						|
//
 | 
						|
 | 
						|
/* Get a value from the current environment */
 | 
						|
char *getenv (const char *varname)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // Null getenv() function implementation to satisfy the linker, since there is
 | 
						|
  // no direct functionality logic dependency in present UEFI cases.
 | 
						|
  //
 | 
						|
  return NULL;
 | 
						|
}
 | 
						|
 | 
						|
/* Get a value from the current environment */
 | 
						|
char *secure_getenv (const char *varname)
 | 
						|
{
 | 
						|
  //
 | 
						|
  // Null secure_getenv() function implementation to satisfy the linker, since
 | 
						|
  // there is no direct functionality logic dependency in present UEFI cases.
 | 
						|
  //
 | 
						|
  // From the secure_getenv() manual: 'just like getenv() except that it
 | 
						|
  // returns NULL in cases where "secure execution" is required'.
 | 
						|
  //
 | 
						|
  return NULL;
 | 
						|
}
 | 
						|
 | 
						|
//
 | 
						|
// -- Stream I/O Routines --
 | 
						|
//
 | 
						|
 | 
						|
/* Write data to a stream */
 | 
						|
size_t fwrite (const void *buffer, size_t size, size_t count, FILE *stream)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
//
 | 
						|
//  -- Dummy OpenSSL Support Routines --
 | 
						|
//
 | 
						|
 | 
						|
int BIO_printf (void *bio, const char *format, ...)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
int BIO_snprintf(char *buf, size_t n, const char *format, ...)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
#ifdef __GNUC__
 | 
						|
 | 
						|
typedef
 | 
						|
VOID
 | 
						|
(EFIAPI *NoReturnFuncPtr)(
 | 
						|
  VOID
 | 
						|
  ) __attribute__((__noreturn__));
 | 
						|
 | 
						|
STATIC
 | 
						|
VOID
 | 
						|
EFIAPI
 | 
						|
NopFunction (
 | 
						|
  VOID
 | 
						|
  )
 | 
						|
{
 | 
						|
}
 | 
						|
 | 
						|
void abort (void)
 | 
						|
{
 | 
						|
  NoReturnFuncPtr NoReturnFunc;
 | 
						|
 | 
						|
  NoReturnFunc = (NoReturnFuncPtr) NopFunction;
 | 
						|
 | 
						|
  NoReturnFunc ();
 | 
						|
}
 | 
						|
 | 
						|
#else
 | 
						|
 | 
						|
void abort (void)
 | 
						|
{
 | 
						|
  // Do nothing
 | 
						|
}
 | 
						|
 | 
						|
#endif
 | 
						|
 | 
						|
int fclose (FILE *f)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
FILE *fopen (const char *c, const char *m)
 | 
						|
{
 | 
						|
  return NULL;
 | 
						|
}
 | 
						|
 | 
						|
size_t fread (void *b, size_t c, size_t i, FILE *f)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
uid_t getuid (void)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
uid_t geteuid (void)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
gid_t getgid (void)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
gid_t getegid (void)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 | 
						|
 | 
						|
int printf (char const *fmt, ...)
 | 
						|
{
 | 
						|
  return 0;
 | 
						|
}
 |