jh163888/UEFITool
1
0
Fork 0
mirror of https://github.com/LongSoft/UEFITool.git synced 2024-11-22 16:08:23 +08:00
Code Issues Projects Releases Wiki Activity

Backport decompressor untrusted data fixes from EDK2

Browse Source
This commit is contained in:
vit9696 2018-11-12 09:20:06 +03:00
parent 5b26775463
commit 8932aebc02
1 changed files with 373 additions and 264 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

543
common/Tiano/EfiTianoDecompress.c
View File

@ -1,7 +1,8 @@
/*++ EfiTianoDecompress.c /*++ EfiTianoDecompress.c
Copyright (c) 2015, Nikolaj Schlej. All rights reserved.<BR> Copyright (c) 2018, LongSoft. All rights reserved.<BR>
Copyright (c) 2004 - 2010, Intel Corporation. All rights reserved.<BR> Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -16,7 +17,7 @@ Decompress.c
Abstract: Abstract:
Decompressor. Algorithm Ported from OPSD code (Decomp.asm) UEFI Decompress Library implementation refer to UEFI specification.
--*/ --*/
@ -79,20 +80,63 @@ typedef struct {
UINT8 mPBit; UINT8 mPBit;
} SCRATCH_DATA; } SCRATCH_DATA;
/*++ STATIC
UINT64
EFIAPI
LShiftU64 (
UINT64 Operand,
UINT32 Count
)
{
return Operand << Count;
}
Routine Description: STATIC
VOID *
EFIAPI
SetMem (
OUT VOID *Buffer,
IN UINTN Length,
IN UINT8 Value
)
{
return memset (Buffer, Value, Length);
}
STATIC
VOID *
EFIAPI
SetMem16 (
OUT VOID *Buffer,
IN UINTN Length,
IN UINT16 Value
)
{
UINTN Index;
UINT16* Buf = (UINT16*)Buffer;
if (Buffer == NULL || Length == 0) {
return Buffer;
}
Length /= sizeof(UINT16);
for (Index = 0; Index < Length; Index++) {
Buf[Index] = Value;
}
return Buffer;
}
/**
Read NumOfBit of bits from source into mBitBuf.
Shift mBitBuf NumOfBits left. Read in NumOfBits of bits from source. Shift mBitBuf NumOfBits left. Read in NumOfBits of bits from source.
Arguments: @param Sd The global scratch data.
@param NumOfBits The number of bits to shift and read.
Sd - The global scratch data **/
NumOfBits - The number of bits to shift and read.
Returns: (VOID)
--*/
STATIC STATIC
VOID VOID
FillBuf ( FillBuf (
@ -100,17 +144,23 @@ FillBuf (
IN UINT16 NumOfBits IN UINT16 NumOfBits
) )
{ {
Sd->mBitBuf = (UINT32) (((UINT64)Sd->mBitBuf) << NumOfBits); //
// Left shift NumOfBits of bits in advance
//
Sd->mBitBuf = (UINT32)LShiftU64 (((UINT64)Sd->mBitBuf), NumOfBits);
//
// Copy data needed in bytes into mSbuBitBuf
//
while (NumOfBits > Sd->mBitCount) { while (NumOfBits > Sd->mBitCount) {
Sd->mBitBuf |= (UINT32) (((UINT64)Sd->mSubBitBuf) << (NumOfBits = (UINT16) (NumOfBits - Sd->mBitCount))); NumOfBits = (UINT16)(NumOfBits - Sd->mBitCount);
Sd->mBitBuf |= (UINT32)LShiftU64 (((UINT64)Sd->mSubBitBuf), NumOfBits);
if (Sd->mCompSize > 0) { if (Sd->mCompSize > 0) {
// //
// Get 1 byte into SubBitBuf // Get 1 byte into SubBitBuf
// //
Sd->mCompSize--; Sd->mCompSize--;
Sd->mSubBitBuf = 0;
Sd->mSubBitBuf = Sd->mSrcBase[Sd->mInBuf++]; Sd->mSubBitBuf = Sd->mSrcBase[Sd->mInBuf++];
Sd->mBitCount = 8; Sd->mBitCount = 8;
} }
@ -123,28 +173,30 @@ FillBuf (
} }
} }
//
// Calculate additional bit count read to update mBitCount
//
Sd->mBitCount = (UINT16)(Sd->mBitCount - NumOfBits); Sd->mBitCount = (UINT16)(Sd->mBitCount - NumOfBits);
//
// Copy NumOfBits of bits from mSubBitBuf into mBitBuf
//
Sd->mBitBuf |= Sd->mSubBitBuf >> Sd->mBitCount; Sd->mBitBuf |= Sd->mSubBitBuf >> Sd->mBitCount;
} }
/*++ /**
Get NumOfBits of bits out from mBitBuf.
Routine Description:
Get NumOfBits of bits out from mBitBuf. Fill mBitBuf with subsequent Get NumOfBits of bits out from mBitBuf. Fill mBitBuf with subsequent
NumOfBits of bits from source. Returns NumOfBits of bits that are NumOfBits of bits from source. Returns NumOfBits of bits that are
popped out. popped out.
Arguments: @param Sd The global scratch data.
@param NumOfBits The number of bits to pop and read.
Sd - The global scratch data. @return The bits that are popped out.
NumOfBits - The number of bits to pop and read.
Returns: **/
The bits that are popped out.
--*/
STATIC STATIC
UINT32 UINT32
GetBits ( GetBits (
@ -154,33 +206,36 @@ GetBits (
{ {
UINT32 OutBits; UINT32 OutBits;
//
// Pop NumOfBits of Bits from Left
//
OutBits = (UINT32)(Sd->mBitBuf >> (BITBUFSIZ - NumOfBits)); OutBits = (UINT32)(Sd->mBitBuf >> (BITBUFSIZ - NumOfBits));
//
// Fill up mBitBuf from source
//
FillBuf (Sd, NumOfBits); FillBuf (Sd, NumOfBits);
return OutBits; return OutBits;
} }
/*++ /**
Routine Description:
Creates Huffman Code mapping table according to code length array. Creates Huffman Code mapping table according to code length array.
Arguments: Creates Huffman Code mapping table for Extra Set, Char&Len Set
and Position Set according to code length array.
If TableBits > 16, then ASSERT ().
Sd - The global scratch data @param Sd The global scratch data.
NumOfChar - Number of symbols in the symbol set @param NumOfChar The number of symbols in the symbol set.
BitLen - Code length array @param BitLen Code length array.
TableBits - The width of the mapping table @param TableBits The width of the mapping table.
Table - The table @param Table The table to be created.
Returns: @retval 0 OK.
@retval BAD_TABLE The table is corrupted.
0 - OK. **/
BAD_TABLE - The table is corrupted.
--*/
STATIC STATIC
UINT16 UINT16
MakeTable ( MakeTable (
@ -203,9 +258,13 @@ MakeTable (
UINT16 Avail; UINT16 Avail;
UINT16 NextCode; UINT16 NextCode;
UINT16 Mask; UINT16 Mask;
UINT16 WordOfStart;
UINT16 WordOfCount;
UINT16 MaxTableLength;
// //
// TableBits should not be greater than 16. // The maximum mapping table width supported by this internal
// working function is 16.
// //
if (TableBits >= (sizeof(Count) / sizeof(UINT16))) { if (TableBits >= (sizeof(Count) / sizeof(UINT16))) {
return (UINT16)BAD_TABLE; return (UINT16)BAD_TABLE;
@ -219,22 +278,19 @@ MakeTable (
} }
for (Index = 0; Index < NumOfChar; Index++) { for (Index = 0; Index < NumOfChar; Index++) {
// if (BitLen[Index] > 16) {
// Count array index should not be greater than or equal to its size.
//
if (BitLen[Index] < (sizeof(Count) / sizeof(UINT16))) {
Count[BitLen[Index]]++;
}
else {
return (UINT16)BAD_TABLE; return (UINT16)BAD_TABLE;
} }
Count[BitLen[Index]]++;
} }
Start[0] = 0; Start[0] = 0;
Start[1] = 0; Start[1] = 0;
for (Index = 1; Index <= 16; Index++) { for (Index = 1; Index <= 16; Index++) {
Start[Index + 1] = (UINT16)(Start[Index] + (Count[Index] << (16 - Index))); WordOfStart = Start[Index];
WordOfCount = Count[Index];
Start[Index + 1] = (UINT16)(WordOfStart + (WordOfCount << (16 - Index)));
} }
if (Start[17] != 0) { if (Start[17] != 0) {
@ -244,6 +300,7 @@ MakeTable (
JuBits = (UINT16)(16 - TableBits); JuBits = (UINT16)(16 - TableBits);
Weight[0] = 0;
for (Index = 1; Index <= TableBits; Index++) { for (Index = 1; Index <= TableBits; Index++) {
Start[Index] >>= JuBits; Start[Index] >>= JuBits;
Weight[Index] = (UINT16)(1U << (TableBits - Index)); Weight[Index] = (UINT16)(1U << (TableBits - Index));
@ -258,13 +315,14 @@ MakeTable (
if (Index != 0) { if (Index != 0) {
Index3 = (UINT16)(1U << TableBits); Index3 = (UINT16)(1U << TableBits);
while (Index != Index3) { if (Index < Index3) {
Table[Index++] = 0; SetMem16 (Table + Index, (Index3 - Index) * sizeof(*Table), 0);
} }
} }
Avail = NumOfChar; Avail = NumOfChar;
Mask = (UINT16)(1U << (15 - TableBits)); Mask = (UINT16)(1U << (15 - TableBits));
MaxTableLength = (UINT16)(1U << TableBits);
for (Char = 0; Char < NumOfChar; Char++) { for (Char = 0; Char < NumOfChar; Char++) {
Len = BitLen[Char]; Len = BitLen[Char];
@ -275,12 +333,14 @@ MakeTable (
NextCode = (UINT16)(Start[Len] + Weight[Len]); NextCode = (UINT16)(Start[Len] + Weight[Len]);
if (Len <= TableBits) { if (Len <= TableBits) {
for (Index = Start[Len]; Index < NextCode; Index++) { for (Index = Start[Len]; Index < NextCode; Index++) {
// Check to prevent possible heap corruption if (Index >= MaxTableLength) {
if (Index >= (UINT16)(1U << TableBits))
return (UINT16)BAD_TABLE; return (UINT16)BAD_TABLE;
}
Table[Index] = Char; Table[Index] = Char;
} }
} }
else { else {
Index3 = Start[Len]; Index3 = Start[Len];
@ -288,29 +348,26 @@ MakeTable (
Index = (UINT16)(Len - TableBits); Index = (UINT16)(Len - TableBits);
while (Index != 0) { while (Index != 0) {
// if (*Pointer == 0 && Avail < (2 * NC - 1)) {
// Avail should be lesser than size of mRight and mLeft to prevent buffer overflow.
//
if ((*Pointer == 0) && (Avail < sizeof(Sd->mRight) / sizeof(UINT16)) && (Avail < sizeof(Sd->mLeft) / sizeof(UINT16))) {
Sd->mRight[Avail] = Sd->mLeft[Avail] = 0; Sd->mRight[Avail] = Sd->mLeft[Avail] = 0;
*Pointer = Avail++; *Pointer = Avail++;
} }
// if (*Pointer < (2 * NC - 1)) {
// *Pointer should be lesser than size of mRight and mLeft to prevent buffer overflow. if ((Index3 & Mask) != 0) {
//
if ((Index3 & Mask) && (*Pointer < (sizeof(Sd->mRight) / sizeof(UINT16)))) {
Pointer = &Sd->mRight[*Pointer]; Pointer = &Sd->mRight[*Pointer];
} }
else if (*Pointer < (sizeof(Sd->mLeft) / sizeof(UINT16))) { else {
Pointer = &Sd->mLeft[*Pointer]; Pointer = &Sd->mLeft[*Pointer];
} }
}
Index3 <<= 1; Index3 <<= 1;
Index--; Index--;
} }
*Pointer = Char; *Pointer = Char;
} }
Start[Len] = NextCode; Start[Len] = NextCode;
@ -321,22 +378,16 @@ MakeTable (
return 0; return 0;
} }
/*++ /**
Routine Description:
Decodes a position value. Decodes a position value.
Arguments: Get a position value according to Position Huffman Table.
Sd - the global scratch data @param Sd The global scratch data.
Returns: @return The position value decoded.
The position value decoded. **/
--*/
STATIC
UINT32 UINT32
DecodeP ( DecodeP (
IN SCRATCH_DATA *Sd IN SCRATCH_DATA *Sd
@ -352,7 +403,7 @@ DecodeP (
Mask = 1U << (BITBUFSIZ - 1 - 8); Mask = 1U << (BITBUFSIZ - 1 - 8);
do { do {
if (Sd->mBitBuf & Mask) { if ((Sd->mBitBuf & Mask) != 0) {
Val = Sd->mRight[Val]; Val = Sd->mRight[Val];
} }
else { else {
@ -375,25 +426,21 @@ DecodeP (
return Pos; return Pos;
} }
/*++ /**
Reads code lengths for the Extra Set or the Position Set.
Routine Description: Read in the Extra Set or Position Set Length Array, then
generate the Huffman code mapping for them.
Reads code lengths for the Extra Set or the Position Set @param Sd The global scratch data.
@param nn The number of symbols.
@param nbit The number of bits needed to represent nn.
@param Special The special symbol that needs to be taken care of.
Arguments: @retval 0 OK.
@retval BAD_TABLE Table is corrupted.
Sd - The global scratch data **/
nn - Number of symbols
nbit - Number of bits needed to represent nn
Special - The special symbol that needs to be taken care of
Returns:
0 - OK.
BAD_TABLE - Table is corrupted.
--*/
STATIC STATIC
UINT16 UINT16
ReadPTLen ( ReadPTLen (
@ -408,6 +455,10 @@ ReadPTLen (
UINT16 Index; UINT16 Index;
UINT32 Mask; UINT32 Mask;
//
// Read Extra Set Code Length Array size
//
Number = (UINT16)GetBits (Sd, nbit); Number = (UINT16)GetBits (Sd, nbit);
if ((Number > sizeof(Sd->mPTLen)) || (nn > sizeof(Sd->mPTLen))) { if ((Number > sizeof(Sd->mPTLen)) || (nn > sizeof(Sd->mPTLen))) {
@ -418,24 +469,29 @@ ReadPTLen (
} }
if (Number == 0) { if (Number == 0) {
//
// This represents only Huffman code used
//
CharC = (UINT16)GetBits (Sd, nbit); CharC = (UINT16)GetBits (Sd, nbit);
for (Index = 0; Index < 256; Index++) { SetMem16 (&Sd->mPTTable[0], sizeof(Sd->mPTTable), CharC);
Sd->mPTTable[Index] = CharC;
}
for (Index = 0; Index < nn; Index++) { SetMem (Sd->mPTLen, nn, 0);
Sd->mPTLen[Index] = 0;
}
return 0; return 0;
} }
Index = 0; Index = 0;
while (Index < Number) { while (Index < Number && Index < NPT) {
CharC = (UINT16)(Sd->mBitBuf >> (BITBUFSIZ - 3)); CharC = (UINT16)(Sd->mBitBuf >> (BITBUFSIZ - 3));
//
// If a code length is less than 7, then it is encoded as a 3-bit
// value. Or it is encoded as a series of "1"s followed by a
// terminating "0". The number of "1"s = Code length - 4.
//
if (CharC == 7) { if (CharC == 7) {
Mask = 1U << (BITBUFSIZ - 1 - 3); Mask = 1U << (BITBUFSIZ - 1 - 3);
while (Mask & Sd->mBitBuf) { while (Mask & Sd->mBitBuf) {
@ -448,40 +504,36 @@ ReadPTLen (
Sd->mPTLen[Index++] = (UINT8)CharC; Sd->mPTLen[Index++] = (UINT8)CharC;
//
// For Code&Len Set,
// After the third length of the code length concatenation,
// a 2-bit value is used to indicated the number of consecutive
// zero lengths after the third length.
//
if (Index == Special) { if (Index == Special) {
CharC = (UINT16)GetBits (Sd, 2); CharC = (UINT16)GetBits (Sd, 2);
while ((INT16)(--CharC) >= 0) { while ((INT16)(--CharC) >= 0 && Index < NPT) {
if (Index >= sizeof(Sd->mPTLen)) {
//
// Fail if Index is greater than or equal to mPTLen
//
return (UINT16)BAD_TABLE;
}
Sd->mPTLen[Index++] = 0; Sd->mPTLen[Index++] = 0;
} }
} }
} }
while (Index < nn) { while (Index < nn && Index < NPT) {
Sd->mPTLen[Index++] = 0; Sd->mPTLen[Index++] = 0;
} }
return MakeTable (Sd, nn, Sd->mPTLen, 8, Sd->mPTTable); return MakeTable (Sd, nn, Sd->mPTLen, 8, Sd->mPTTable);
} }
/*++ /**
Routine Description:
Reads code lengths for Char&Len Set. Reads code lengths for Char&Len Set.
Arguments: Read in and decode the Char&Len Set Code Length Array, then
generate the Huffman Code mapping table for the Char&Len Set.
Sd - the global scratch data @param Sd The global scratch data.
Returns: (VOID) **/
--*/
STATIC STATIC
VOID VOID
ReadCLen ( ReadCLen (
@ -496,26 +548,25 @@ ReadCLen (
Number = (UINT16)GetBits (Sd, CBIT); Number = (UINT16)GetBits (Sd, CBIT);
if (Number == 0) { if (Number == 0) {
//
// This represents only Huffman code used
//
CharC = (UINT16)GetBits (Sd, CBIT); CharC = (UINT16)GetBits (Sd, CBIT);
for (Index = 0; Index < NC; Index++) { SetMem (Sd->mCLen, NC, 0);
Sd->mCLen[Index] = 0; SetMem16 (&Sd->mCTable[0], sizeof(Sd->mCTable), CharC);
}
for (Index = 0; Index < 4096; Index++) {
Sd->mCTable[Index] = CharC;
}
return; return;
} }
Index = 0; Index = 0;
while (Index < Number) { while (Index < Number && Index < NC) {
CharC = Sd->mPTTable[Sd->mBitBuf >> (BITBUFSIZ - 8)]; CharC = Sd->mPTTable[Sd->mBitBuf >> (BITBUFSIZ - 8)];
if (CharC >= NT) { if (CharC >= NT) {
Mask = 1U << (BITBUFSIZ - 1 - 8); Mask = 1U << (BITBUFSIZ - 1 - 8);
do { do {
if (Mask & Sd->mBitBuf) { if (Mask & Sd->mBitBuf) {
CharC = Sd->mRight[CharC]; CharC = Sd->mRight[CharC];
} }
@ -524,6 +575,7 @@ ReadCLen (
} }
Mask >>= 1; Mask >>= 1;
} while (CharC >= NT); } while (CharC >= NT);
} }
// //
@ -532,6 +584,7 @@ ReadCLen (
FillBuf (Sd, Sd->mPTLen[CharC]); FillBuf (Sd, Sd->mPTLen[CharC]);
if (CharC <= 2) { if (CharC <= 2) {
if (CharC == 0) { if (CharC == 0) {
CharC = 1; CharC = 1;
} }
@ -542,39 +595,37 @@ ReadCLen (
CharC = (UINT16)(GetBits (Sd, CBIT) + 20); CharC = (UINT16)(GetBits (Sd, CBIT) + 20);
} }
while ((INT16)(--CharC) >= 0) { while ((INT16)(--CharC) >= 0 && Index < NC) {
Sd->mCLen[Index++] = 0; Sd->mCLen[Index++] = 0;
} }
} }
else { else {
Sd->mCLen[Index++] = (UINT8)(CharC - 2); Sd->mCLen[Index++] = (UINT8)(CharC - 2);
} }
} }
while (Index < NC) { SetMem (Sd->mCLen + Index, NC - Index, 0);
Sd->mCLen[Index++] = 0;
}
MakeTable (Sd, NC, Sd->mCLen, 12, Sd->mCTable); MakeTable (Sd, NC, Sd->mCLen, 12, Sd->mCTable);
return; return;
} }
/*++ /**
Routine Description:
Decode a character/length value. Decode a character/length value.
Arguments: Read one value from mBitBuf, Get one code from mBitBuf. If it is at block boundary, generates
Huffman code mapping table for Extra Set, Code&Len Set and
Position Set.
Sd - The global scratch data. @param Sd The global scratch data.
Returns: @return The value decoded.
The value decoded. **/
--*/
STATIC STATIC
UINT16 UINT16
DecodeC ( DecodeC (
@ -587,21 +638,38 @@ DecodeC (
if (Sd->mBlockSize == 0) { if (Sd->mBlockSize == 0) {
// //
// Starting a new block // Starting a new block
// Read BlockSize from block header
// //
Sd->mBlockSize = (UINT16)GetBits (Sd, 16); Sd->mBlockSize = (UINT16)GetBits (Sd, 16);
//
// Read in the Extra Set Code Length Array,
// Generate the Huffman code mapping table for Extra Set.
//
Sd->mBadTableFlag = ReadPTLen (Sd, NT, TBIT, 3); Sd->mBadTableFlag = ReadPTLen (Sd, NT, TBIT, 3);
if (Sd->mBadTableFlag != 0) { if (Sd->mBadTableFlag != 0) {
return 0; return 0;
} }
//
// Read in and decode the Char&Len Set Code Length Array,
// Generate the Huffman code mapping table for Char&Len Set.
//
ReadCLen (Sd); ReadCLen (Sd);
//
// Read in the Position Set Code Length Array,
// Generate the Huffman code mapping table for the Position Set.
//
Sd->mBadTableFlag = ReadPTLen (Sd, MAXNP, Sd->mPBit, (UINT16)(-1)); Sd->mBadTableFlag = ReadPTLen (Sd, MAXNP, Sd->mPBit, (UINT16)(-1));
if (Sd->mBadTableFlag != 0) { if (Sd->mBadTableFlag != 0) {
return 0; return 0;
} }
} }
//
// Get one code according to Code&Set Huffman Table
//
Sd->mBlockSize--; Sd->mBlockSize--;
Index2 = Sd->mCTable[Sd->mBitBuf >> (BITBUFSIZ - 12)]; Index2 = Sd->mCTable[Sd->mBitBuf >> (BITBUFSIZ - 12)];
@ -609,7 +677,7 @@ DecodeC (
Mask = 1U << (BITBUFSIZ - 1 - 12); Mask = 1U << (BITBUFSIZ - 1 - 12);
do { do {
if (Sd->mBitBuf & Mask) { if ((Sd->mBitBuf & Mask) != 0) {
Index2 = Sd->mRight[Index2]; Index2 = Sd->mRight[Index2];
} }
else { else {
@ -627,33 +695,33 @@ DecodeC (
return Index2; return Index2;
} }
/*++ /**
Routine Description:
Decode the source data and put the resulting data into the destination buffer. Decode the source data and put the resulting data into the destination buffer.
Arguments: @param Sd The global scratch data.
Sd - The global scratch data **/
Returns: (VOID)
--*/
STATIC STATIC
VOID VOID
Decode ( Decode (
SCRATCH_DATA *Sd SCRATCH_DATA *Sd
) )
{ {
UINT16 BytesRemain = (UINT16)(-1); UINT16 BytesRemain;
UINT32 DataIdx = 0; UINT32 DataIdx;
UINT16 CharC = 0; UINT16 CharC;
BytesRemain = (UINT16)(-1);
DataIdx = 0;
for (;;) { for (;;) {
//
// Get one code from mBitBuf
//
CharC = DecodeC(Sd); CharC = DecodeC(Sd);
if (Sd->mBadTableFlag != 0) { if (Sd->mBadTableFlag != 0) {
return; goto Done;
} }
if (CharC < 256) { if (CharC < 256) {
@ -661,106 +729,151 @@ Decode (
// Process an Original character // Process an Original character
// //
if (Sd->mOutBuf >= Sd->mOrigSize) { if (Sd->mOutBuf >= Sd->mOrigSize) {
return; goto Done;
} }
else { else {
//
// Write orignal character into mDstBase
//
Sd->mDstBase[Sd->mOutBuf++] = (UINT8)CharC; Sd->mDstBase[Sd->mOutBuf++] = (UINT8)CharC;
} }
} }
else { else {
// //
// Process a Pointer // Process a Pointer
// //
CharC = (UINT16)(CharC - (UINT8_MAX + 1 - THRESHOLD)); CharC = (UINT16)(CharC - (0x00000100U - THRESHOLD));
//
// Get string length
//
BytesRemain = CharC; BytesRemain = CharC;
//
// Locate string position
//
DataIdx = Sd->mOutBuf - DecodeP(Sd) - 1; DataIdx = Sd->mOutBuf - DecodeP(Sd) - 1;
// Check to prevent possible heap corruption //
if (DataIdx >= Sd->mOrigSize - BytesRemain) { // Write BytesRemain of bytes into mDstBase
Sd->mBadTableFlag = 1; //
return;
}
BytesRemain--; BytesRemain--;
while ((INT16)(BytesRemain) >= 0) { while ((INT16)(BytesRemain) >= 0) {
Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
if (Sd->mOutBuf >= Sd->mOrigSize) { if (Sd->mOutBuf >= Sd->mOrigSize) {
return; goto Done;
} }
if (DataIdx >= Sd->mOrigSize) {
Sd->mBadTableFlag = (UINT16)BAD_TABLE;
goto Done;
}
Sd->mDstBase[Sd->mOutBuf++] = Sd->mDstBase[DataIdx++];
BytesRemain--; BytesRemain--;
} }
//
// Once mOutBuf is fully filled, directly return
//
if (Sd->mOutBuf >= Sd->mOrigSize) {
goto Done;
} }
} }
} }
/*++ Done:
return;
}
Routine Description: /**
Given a compressed source buffer, this function retrieves the size of
the uncompressed buffer and the size of the scratch buffer required
to decompress the compressed source buffer.
The internal implementation of *_DECOMPRESS_PROTOCOL.GetInfo(). Retrieves the size of the uncompressed buffer and the temporary scratch buffer
required to decompress the buffer specified by Source and SourceSize.
If the size of the uncompressed buffer or the size of the scratch buffer cannot
be determined from the compressed data specified by Source and SourceData,
then EFI_INVALID_PARAMETER is returned. Otherwise, the size of the uncompressed
buffer is returned in DestinationSize, the size of the scratch buffer is returned
in ScratchSize, and EFI_SUCCESS is returned.
This function does not have scratch buffer available to perform a thorough
checking of the validity of the source data. It just retrieves the "Original Size"
field from the beginning bytes of the source data and output it as DestinationSize.
And ScratchSize is specific to the decompression implementation.
Arguments: @param Source The source buffer containing the compressed data.
@param SourceSize The size, in bytes, of the source buffer.
@param DestinationSize A pointer to the size, in bytes, of the uncompressed buffer
that will be generated when the compressed buffer specified
by Source and SourceSize is decompressed.
@param ScratchSize A pointer to the size, in bytes, of the scratch buffer that
is required to decompress the compressed buffer specified
by Source and SourceSize.
Source - The source buffer containing the compressed data. @retval EFI_SUCCESS The size of the uncompressed data was returned
SrcSize - The size of source buffer in DestinationSize, and the size of the scratch
DstSize - The size of destination buffer. buffer was returned in ScratchSize.
ScratchSize - The size of scratch buffer. @retval EFI_INVALID_PARAMETER
The size of the uncompressed data or the size of
Returns: the scratch buffer cannot be determined from
the compressed data specified by Source
EFI_SUCCESS - The size of destination buffer and the size of scratch buffer are successull retrieved. and SourceSize.
EFI_INVALID_PARAMETER - The source data is corrupted **/
--*/
EFI_STATUS EFI_STATUS
EFIAPI
GetInfo ( GetInfo (
IN const VOID *Source, IN CONST VOID *Source,
IN UINT32 SrcSize, IN UINT32 SourceSize,
OUT UINT32 *DstSize, OUT UINT32 *DestinationSize,
OUT UINT32 *ScratchSize OUT UINT32 *ScratchSize
) )
{ {
const UINT8 *Src; UINT32 CompressedSize;
*ScratchSize = sizeof(SCRATCH_DATA); if (Source == NULL || DestinationSize == NULL || ScratchSize == NULL || SourceSize < 8) {
Src = Source;
if (SrcSize < 8) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
*DstSize = Src[4] + (Src[5] << 8) + (Src[6] << 16) + (Src[7] << 24); CompressedSize = *(UINT32 *)Source;
if (SourceSize < (CompressedSize + 8) || (CompressedSize + 8) < 8) {
return EFI_INVALID_PARAMETER;
}
*ScratchSize = sizeof(SCRATCH_DATA);
*DestinationSize = *((UINT32 *)Source + 1);
return EFI_SUCCESS; return EFI_SUCCESS;
} }
/*++ /**
Decompresses a compressed source buffer.
Routine Description: Extracts decompressed data to its original form.
This function is designed so that the decompression algorithm can be implemented
without using any memory services. As a result, this function is not allowed to
call any memory allocation services in its implementation. It is the caller's
responsibility to allocate and free the Destination and Scratch buffers.
If the compressed source data specified by Source is successfully decompressed
into Destination, then RETURN_SUCCESS is returned. If the compressed source data
specified by Source is not in a valid compressed data format,
then RETURN_INVALID_PARAMETER is returned.
The internal implementation of *_DECOMPRESS_PROTOCOL.Decompress(). @param Source The source buffer containing the compressed data.
@param Destination The destination buffer to store the decompressed data.
@param Scratch A temporary scratch buffer that is used to perform the decompression.
This is an optional parameter that may be NULL if the
required scratch buffer size is 0.
Arguments: @retval EFI_SUCCESS Decompression completed successfully, and
the uncompressed buffer is returned in Destination.
Source - The source buffer containing the compressed data. @retval EFI_INVALID_PARAMETER
SrcSize - The size of source buffer The source buffer specified by Source is corrupted
Destination - The destination buffer to store the decompressed data (not in a valid compressed format).
DstSize - The size of destination buffer. **/
Scratch - The buffer used internally by the decompress routine. This buffer is needed to store intermediate data.
ScratchSize - The size of scratch buffer.
Version - The version of de/compression algorithm.
Version 1 for EFI 1.1 de/compression algorithm.
Version 2 for Tiano de/compression algorithm.
Returns:
EFI_SUCCESS - Decompression is successful
EFI_INVALID_PARAMETER - The source data is corrupted
--*/
EFI_STATUS EFI_STATUS
EFIAPI
Decompress ( Decompress (
IN CONST VOID *Source, IN CONST VOID *Source,
IN UINT32 SrcSize, IN UINT32 SrcSize,
@ -771,17 +884,12 @@ Decompress (
IN UINT8 Version IN UINT8 Version
) )
{ {
UINT32 Index;
UINT32 CompSize; UINT32 CompSize;
UINT32 OrigSize; UINT32 OrigSize;
EFI_STATUS Status;
SCRATCH_DATA *Sd; SCRATCH_DATA *Sd;
const UINT8 *Src; CONST UINT8 *Src = Source;
UINT8 *Dst; UINT8 *Dst = Destination;
EFI_STATUS Status = EFI_SUCCESS;
Status = EFI_SUCCESS;
Src = Source;
Dst = Destination;
if (ScratchSize < sizeof(SCRATCH_DATA)) { if (ScratchSize < sizeof(SCRATCH_DATA)) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
@ -813,9 +921,7 @@ Decompress (
Src = Src + 8; Src = Src + 8;
for (Index = 0; Index < sizeof(SCRATCH_DATA); Index++) { SetMem (Sd, sizeof(SCRATCH_DATA), 0);
((UINT8 *)Sd)[Index] = 0;
}
// //
// The length of the field 'Position Set Code Length Array Size' in Block Header. // The length of the field 'Position Set Code Length Array Size' in Block Header.
// For EFI 1.1 de/compression algorithm(Version 1), mPBit = 4 // For EFI 1.1 de/compression algorithm(Version 1), mPBit = 4
@ -839,6 +945,9 @@ Decompress (
Sd->mSrcBase = (UINT8*)Src; Sd->mSrcBase = (UINT8*)Src;
Sd->mDstBase = Dst; Sd->mDstBase = Dst;
//
// CompSize and OrigSize are calculated in bytes
//
Sd->mCompSize = CompSize; Sd->mCompSize = CompSize;
Sd->mOrigSize = OrigSize; Sd->mOrigSize = OrigSize;