Skip to content

Fix unbounded recursion (DoS) in UefiParser.parse_firmware_volume via zero-length FV header #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sys-xmlcli wants to merge 1 commit into
base: main
Choose a base branch
from
+3 −1
Open

Fix unbounded recursion (DoS) in UefiParser.parse_firmware_volume via zero-length FV header #115

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/xmlcli/common/bios_fw_parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,9 @@ def store_guid(self, buffer, start, end, guid, nesting_level, is_compressed=Fals
def is_valid_fv(firmware_volume_header):
has_valid_signature = firmware_volume_header.Signature == structure.FV_SIGNATURE
has_valid_zero_vector = utils.get_integer_value(firmware_volume_header.get_value("ZeroVector")) == 0
if has_valid_signature and has_valid_zero_vector:
# FvLength must be non-zero to guarantee forward progress on the recursive parse walk
has_valid_length = utils.get_integer_value(firmware_volume_header.get_value("FvLength")) > 0
if has_valid_signature and has_valid_zero_vector and has_valid_length:
return True
else:
log.debug(firmware_volume_header.dump_dict())
Expand Down
Loading