Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 6d127c21406c89b50f6c7345f02c2b958660e231
https://github.com/tianocore/edk2/commit/6d127c21406c89b50f6c7345f02c2b958660e231
Author: Phineas Su <[email protected]>
Date: 2026-06-25 (Thu, 25 Jun 2026)
Changed paths:
M ManageabilityPkg/Universal/IpmiBlobTransferDxe/IpmiBlobTransferDxe.c
M
ManageabilityPkg/Universal/IpmiBlobTransferDxe/UnitTest/IpmiBlobTransferTestUnitTests.c
Log Message:
-----------
ManageabilityPkg: Fix IPMI vulnerabilities and memory leak
Fix vulnerabilities and a memory leak in the IPMI Blob Transfer driver:
- Prevent integer underflow and OOB read by validating response size before
accessing CompletionCode, OEN, and CRC.
- Prevent buffer overflow by ensuring BMC response size does not exceed the
caller's buffer capacity, avoiding potential memory overwriting.
- Fix memory leak by freeing IpmiResponseData and IpmiSendData.
Additionally, fix unit test failures caused by the changes and pre-existing
bugs:
- Allocate a safe fixed size (70 bytes) for IpmiResponseData in
IpmiBlobTransferSendIpmi to prevent heap overflow if the BMC returns
more data than expected. Add validation to check if returned size
exceeds this allocation.
- Modify IpmiBlobTransferStat and IpmiBlobTransferSessionStat to only
copy MetaDataLen bytes of metadata instead of always copying the max
size (64 bytes), preventing buffer overflow when caller allocates
a smaller buffer.
- Add missing ASSERT(FALSE) in IpmiBlobTransferStat parameter validation.
- Fix IpmiBlobTransferWriteMeta parameter validation to allow 0-length
writes (Data can be NULL when WriteLength is 0), which was causing
test failure.
- Fix syntax errors in unit tests where arrays were assigned values
after declaration using brace-enclosed lists.
- Fix sizeof misuse on macros representing size values in unit tests,
which caused too small allocations and buffer overflows in mock setups.
- Fix queue order in OpenValidResponse test to match the actual call
order (GetCount, Enumerate, Open) and free all mock buffers.
- Remove unnecessary MockIpmiSubmitCommand calls from invalid buffer
tests to prevent mock queue leaks to subsequent tests.
- Fix memory leaks of ExpectedMetadata in unit tests by changing them
to static arrays.
Signed-off-by: Phineas Su <[email protected]>
To unsubscribe from these emails, change your notification settings at
https://github.com/tianocore/edk2/settings/notifications
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
