SecurityPkg/DxeImageVerificationLib: Fix memory leaks (CVE-2019-14575)

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608 Pointer HashCtx used in IsCertHashFoundInDatabase() is not freed inside the while-loop, if it will run more than once. Cc: Jiewen Yao <[email protected]> Cc: Chao Zhang <[email protected]> Signed-off-by: Jian J Wang <[email protected]> Reviewed-by: Jiewen Yao <[email protected]>
tianocore · Feb 19, 2020 · fbb9607 · fbb9607
1 parent 578bcdc
commit fbb9607
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -908,6 +908,9 @@ IsCertHashFoundInDatabase (
       goto Done;
     }
 
+    FreePool (HashCtx);
+    HashCtx = NULL;
+
     SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;
     CertHash          = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);
     CertHashCount     = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;