[Feature]: Ensure that PE image sections contain all data between headers and signature and do not overlap #11693
Description
Feature Overview
The PE header hashing code does not check that the section headers contain all data between the image header and the signature. It also does not check that they do not overlap. If these conditions are violated, the hash will be computed incorrectly.
Solution Overview
Reject PE images that violate this rule, perhaps in PeCoffLoaderGetPeHeader().
Alternatives Considered
None
What packages are impacted?
OvmfPkg, MdePkg, SecurityPkg
Urgency
Medium
Are you going to implement the feature request?
I will implement the feature
Do you need maintainer feedback?
Maintainer feedback requested
Anything else?
This does reject images that would previously have been accepted, but I believe these images are nonsensical. Also, it is not possible to modify the an existing image to be malformed in this way without breaking the signature.