47b7678 NetworkPkg/IScsiDxe: fix IScsiHexToBin() hex parsing

2 files Authored by lersek 3 years ago, Committed by mergify[bot] 3 years ago,
    NetworkPkg/IScsiDxe: fix IScsiHexToBin() hex parsing
    
    The IScsiHexToBin() function has the following parser issues:
    
    (1) If the *subject sequence* in "HexStr" is empty, the function returns
        EFI_SUCCESS (with "BinLength" set to 0 on output). Such inputs should
        be rejected.
    
    (2) The function mis-handles a "HexStr" that ends with a stray nibble. For
        example, if "HexStr" is "0xABC", the function decodes it to the bytes
        {0xAB, 0x0C}, sets "BinLength" to 2 on output, and returns
        EFI_SUCCESS. Such inputs should be rejected.
    
    (3) If an invalid hex char is found in "HexStr", the function treats it as
        end-of-hex-string, and returns EFI_SUCCESS. Such inputs should be
        rejected.
    
    All of the above cases are remotely triggerable, as shown in a subsequent
    patch, which adds error checking to the IScsiHexToBin() call sites. While
    the initiator is not immediately compromised, incorrectly parsing CHAP_R
    from the target, in case of mutual authentication, is not great.
    
    Extend the interface contract of IScsiHexToBin() with
    EFI_INVALID_PARAMETER, for reporting issues (1) through (3), and implement
    the new checks.
    
    Cc: Jiaxin Wu <jiaxin.wu@intel.com>
    Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
    Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
    Cc: Siyuan Fu <siyuan.fu@intel.com>
    Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356
    Signed-off-by: Laszlo Ersek <lersek@redhat.com>
    Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
    Message-Id: <20210608121259.32451-9-lersek@redhat.com>