From 536e9651edb1b05ff417f323b9cd7294cf20e692 Mon Sep 17 00:00:00 2001 From: John Zhao Date: Tue, 4 Aug 2020 11:29:08 -0700 Subject: security/intel/txt: Avoid shifting by a negative value Coverity detects an integer handling issue with BAD_SHIFT. The inline function log2_ceil(u32 x) { return (x == 0) ? -1 : log2(x * 2 - 1); } could return -1, which causes shifting by a negative amount value and has undefined behavior. Add sanity check for the acm_header->size to avoid shifting negative value. Found-by: Coverity CID 1431124 TEST=None Signed-off-by: John Zhao Change-Id: Ic687349b14917e39d2a8186968037ca2521c7cdc Reviewed-on: https://review.coreboot.org/c/coreboot/+/44186 Tested-by: build bot (Jenkins) Reviewed-by: Tim Wawrzynczak Reviewed-by: Angel Pons --- src/security/intel/txt/common.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index d3e18376a5..f16bbea141 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -149,6 +149,9 @@ static int validate_acm(const void *ptr) if (acm_header->module_vendor != INTEL_ACM_VENDOR) return ACM_E_MODULE_VENDOR_NOT_INTEL; + if (acm_header->size == 0) + return ACM_E_SIZE_INCORRECT; + if (((acm_header->header_len + acm_header->scratch_size) * sizeof(uint32_t) + sizeof(struct acm_info_table)) > (acm_header->size & 0xffffff) * sizeof(uint32_t)) { return ACM_E_SIZE_INCORRECT; -- cgit v1.2.3