An EFI image may be read from a raw partition far larger than the image. Add efi_pe_image_size(), which derives the size as written from the section and certificate tables and needs only the headers; efi_pe_file_size(), the same for a buffer holding the whole image; and efi_pe_find_section() and efi_pe_find_next_section(), which return the file data of the first or the next section of a name.
All of them parse untrusted images through efi_image_parse_header(). For efi_pe_image_size() to work on a buffer holding only the headers, the check that the certificate table lies within the buffer moves from efi_image_parse_header() to efi_image_parse(), the only caller that reads the table. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Johannes Schneider <[email protected]> --- efi/loader/pe.c | 116 +++++++++++++++++++++++++++++++++++++++- include/efi/loader/pe.h | 7 +++ 2 files changed, 121 insertions(+), 2 deletions(-) diff --git a/efi/loader/pe.c b/efi/loader/pe.c index 4b7874fe2a..827b50378c 100644 --- a/efi/loader/pe.c +++ b/efi/loader/pe.c @@ -507,8 +507,6 @@ static bool efi_image_parse_header(void *efi, size_t len, return false; if (!pe_range_ok(len, 0, *header_sizep)) return false; - if (*authszp && !pe_range_ok(len, *authoffp, *authszp)) - return false; if (!pe_range_ok(len, 0, csum_off) || !pe_range_ok(len, subsys_off, 0) || @@ -570,6 +568,8 @@ bool efi_image_parse(void *efi, size_t len, struct efi_image_regions **regp, if (!efi_image_parse_header(efi, len, &nt, §ions, &header_size, &align, &authoff, &authsz)) return false; + if (authsz && !pe_range_ok(len, authoff, authsz)) + return false; /* * Count maximum number of regions to be digested. @@ -780,6 +780,118 @@ static int fuzz_pe(const u8 *data, size_t size) } fuzz_test("pe", fuzz_pe); +/** + * efi_pe_image_size() - size of a PE image as written to storage + * @efi: buffer holding at least the PE headers + * @len: size of @efi + * + * Return: the end of the last section or of the certificate table, whichever + * is further, which may lie beyond @len, or 0 if @efi holds no valid PE + * headers. + */ +size_t efi_pe_image_size(void *efi, size_t len) +{ + IMAGE_NT_HEADERS32 *nt; + IMAGE_SECTION_HEADER *sections; + u32 header_size, align, authoff, authsz; + size_t size, end; + int i; + + if (!efi_image_parse_header(efi, len, &nt, §ions, &header_size, + &align, &authoff, &authsz)) + return 0; + + size = header_size; + + for (i = 0; i < nt->FileHeader.sections; i++) { + if (check_add_overflow((size_t)sections[i].PointerToRawData, + (size_t)sections[i].SizeOfRawData, &end)) + return 0; + size = max(size, end); + } + + if (check_add_overflow((size_t)authoff, (size_t)authsz, &end)) + return 0; + + return max(size, end); +} + +/** + * efi_pe_file_size() - size of a PE image held completely in a buffer + * @efi: buffer holding the image + * @len: size of @efi, possibly larger than the image + * + * Return: efi_pe_image_size(), or 0 if the image does not fit into @len. + */ +size_t efi_pe_file_size(void *efi, size_t len) +{ + size_t size = efi_pe_image_size(efi, len); + + return size <= len ? size : 0; +} + +/** + * efi_pe_find_next_section() - locate the next section of a name + * @efi: PE image + * @len: size of @efi + * @name: section name, at most 8 characters + * @size: returns the size of the section data + * @index: section table index to start at; set past the section found + * + * Return: pointer to the section data in @efi, or NULL if there is none. + */ +const void *efi_pe_find_next_section(void *efi, size_t len, const char *name, + size_t *size, int *index) +{ + IMAGE_NT_HEADERS32 *nt; + IMAGE_SECTION_HEADER *sections; + u32 header_size, align, authoff, authsz; + size_t namelen = strlen(name), sz; + int i; + + if (namelen > 8) + return NULL; + + if (!efi_image_parse_header(efi, len, &nt, §ions, &header_size, + &align, &authoff, &authsz)) + return NULL; + + for (i = *index; i < nt->FileHeader.sections; i++) { + if (memcmp(sections[i].Name, name, namelen) || + (namelen < 8 && sections[i].Name[namelen])) + continue; + + sz = sections[i].Misc.VirtualSize ?: sections[i].SizeOfRawData; + sz = min_t(size_t, sz, sections[i].SizeOfRawData); + if (!pe_range_ok(len, sections[i].PointerToRawData, sz)) + return NULL; + + *size = sz; + *index = i + 1; + return efi + sections[i].PointerToRawData; + } + + return NULL; +} + +/** + * efi_pe_find_section() - locate a section's file data by name + * @efi: PE image + * @len: size of @efi + * @name: section name, at most 8 characters + * @size: returns the size of the section data + * + * Return: pointer to the first section's data in @efi, or NULL if there is + * none. + */ +const void *efi_pe_find_section(void *efi, size_t len, const char *name, + size_t *size) +{ + int index = 0; + + return efi_pe_find_next_section(efi, len, name, size, &index); +} + #ifdef CONFIG_EFI_LOADER static bool efi_image_authenticate(void *efi, size_t efi_size) { diff --git a/include/efi/loader/pe.h b/include/efi/loader/pe.h index b99f517cbf..2d2a19604f 100644 --- a/include/efi/loader/pe.h +++ b/include/efi/loader/pe.h @@ -73,6 +73,13 @@ void *efi_prepare_aligned_image(void *efi, u64 *efi_size); bool efi_image_parse(void *efi, size_t len, struct efi_image_regions **regp, struct _WIN_CERTIFICATE **auth, size_t *auth_len); +size_t efi_pe_image_size(void *efi, size_t len); +size_t efi_pe_file_size(void *efi, size_t len); +const void *efi_pe_find_next_section(void *efi, size_t len, const char *name, + size_t *size, int *index); +const void *efi_pe_find_section(void *efi, size_t len, const char *name, + size_t *size); + /* Check if a buffer contains a PE-COFF image */ efi_status_t efi_check_pe(void *buffer, size_t size, void **nt_header); /* PE loader implementation */ -- 2.43.0
