Re: [PATCH] ShellPkg: Avoid buffer out-of-bound access

["Shi, Steven" <steven.shi@intel.com>]

Reviewed-by: Steven Shi <steven.shi@intel.com>

Thanks
Steven Shi


> -----Original Message-----
> From: Ni, Ruiyu
> Sent: Wednesday, July 26, 2017 4:22 PM
> To: edk2-devel@lists.01.org
> Cc: Shi, Steven <steven.shi@intel.com>
> Subject: [PATCH] ShellPkg: Avoid buffer out-of-bound access
> 
> PathSize is the number of bytes in PathForReturn buffer so
> PathForReturn[PathSize - 1] incorrectly accesses the last
> character in the buffer,
> PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used.
> 
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
> Cc: Steven Shi <steven.shi@intel.com>
> ---
>  ShellPkg/Application/Shell/ShellProtocol.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/ShellPkg/Application/Shell/ShellProtocol.c
> b/ShellPkg/Application/Shell/ShellProtocol.c
> index b3b8acc0d0..991fb58ca7 100644
> --- a/ShellPkg/Application/Shell/ShellProtocol.c
> +++ b/ShellPkg/Application/Shell/ShellProtocol.c
> @@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath(
>          //  UEFI Shell spec section 3.7)
>          if ((PathSize != 0)                        &&
>              (PathForReturn != NULL)                &&
> -            (PathForReturn[PathSize - 1] != L'\\') &&
> +            (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') &&
>              (AlignedNode->PathName[0]    != L'\\')) {
>            PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1);
>          }
> --
> 2.12.2.windows.2