Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 75400a462b52c349dd070e6f6d435511cbf7db13
https://github.com/tianocore/edk2/commit/75400a462b52c349dd070e6f6d435511cbf7db13
Author: Anandh Krishna U <[email protected]>
Date: 2026-09-29 (Tue, 29 Sep 2026)
Changed paths:
M SecurityPkg/Library/FmpAuthenticationLibPkcs7/FmpAuthenticationLibPkcs7.c
Log Message:
-----------
SecurityPkg/FmpAuthenticationLibPkcs7: Use pages for scratch buffer
FmpAuthenticatedHandlerPkcs7() allocates a scratch buffer whose size is
(ImageSize - AuthInfo.Hdr.dwLength): the full firmware payload plus the
8-byte monotonic count, assembled contiguously for Pkcs7Verify().
The library declares support for the DXE and post-memory PEI phases.
In PEI, MemoryAllocationLib's AllocatePool() maps to PeiAllocatePool(),
which builds an EFI_HOB_TYPE_MEMORY_POOL HOB and rejects any request
larger than (0xFFF8 - sizeof (EFI_HOB_MEMORY_POOL)), i.e. just under
64 KiB. PeiAllocatePool() itself notes that a post-memory PEIM wanting a
larger pool should use the AllocatePages service instead.
As a result, authenticating any image whose payload exceeds that limit
fails at allocation with RETURN_OUT_OF_RESOURCES before Pkcs7Verify() is
ever called. Callers that map this to a status code report an
authentication/security failure for an otherwise validly signed image.
Allocate the scratch buffer with AllocatePages (EFI_SIZE_TO_PAGES (Size))
and release it with the matching FreePages (). The data assembled for
Pkcs7Verify() is unchanged, so authentication results are identical for
valid and invalid signatures. The DXE phase is unaffected because its
pool allocator has no comparable size limit.
Cc: Jiewen Yao <[email protected]>
Cc: Chris Fernald <[email protected]>
Signed-off-by: Anandh krishna U <[email protected]>
To unsubscribe from these emails, change your notification settings at
https://github.com/tianocore/edk2/settings/notifications
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
