Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 24788b6190abc736d614a7218f72ac7a0f27924a
https://github.com/tianocore/edk2/commit/24788b6190abc736d614a7218f72ac7a0f27924a
Author: Syed Mohammed Nayyar <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M NetworkPkg/IScsiDxe/IScsiProto.c
Log Message:
-----------
NetworkPkg/IScsiDxe: bound value length in IScsiBuildKeyValueList
IScsiBuildKeyValueList parses the data segment of a received iSCSI
login, text or CHAP response into key=value pairs. After locating '='
within the remaining length, it sets KeyValuePair->Value and calls
AsciiStrLen(Value) to measure the value before subtracting it from the
remaining length. AsciiStrLen has no length cap, and the data segment
copied from the received PDU (AllocatePool(Len) + NetbufQueCopy of the
data-segment length) is not guaranteed to be NUL-terminated.
A malicious or redirecting target can send a data segment whose final
value lacks a trailing NUL (e.g. the 3 bytes "X=Y"), so AsciiStrLen
reads past the end of the segment allocation, an attacker-controlled
out-of-bounds read. The SafeUint32Sub bound check only runs after the
over-read.
Replace AsciiStrLen(Value) with AsciiStrnLenS(Value, Len), capping the
scan to the bytes remaining from Value onward. An unterminated value
then returns Len and the existing SafeUint32Sub rejects the segment.
The single change covers all three callers (login redirect, operational
parameter negotiation and CHAP).
Signed-off-by: Syed Mohammed Nayyar <[email protected]>
To unsubscribe from these emails, change your notification settings at
https://github.com/tianocore/edk2/settings/notifications
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
