From: Hao Wu <hao.a.wu@intel.com>
To: edk2-devel@lists.01.org
Cc: Hao Wu <hao.a.wu@intel.com>, Jiewen Yao <jiewen.yao@intel.com>,
Liming Gao <liming.gao@intel.com>,
Michael Kinney <michael.d.kinney@intel.com>
Subject: [PATCH v2 2/2] MdeModulePkg/PrintLib: Avoid reading content beyond the format string
Date: Wed, 31 May 2017 14:13:19 +0800 [thread overview]
Message-ID: <20170531061319.21976-3-hao.a.wu@intel.com> (raw)
In-Reply-To: <20170531061319.21976-1-hao.a.wu@intel.com>
https://bugzilla.tianocore.org/show_bug.cgi?id=567
In functions DxePrintLibPrint2ProtocolVaListToBaseList() and
InternalPrintLibSPrintMarker(), when processing ASCII format strings, if
the format string walker pointer 'Format' is pointing at the end of the
format string (i.e. '\0'), the following expression:
*(Format + 1)
will read an undefined value.
Though this value won't affect the functionality, since it will be masked
by variable 'FormatMask':
(*(Format + 1) << 8)) & FormatMask
(FormatMask is 0xff for ASCII format string)
This commit adds additional logic to avoid reading undefined content.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Michael Kinney <michael.d.kinney@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c | 22 ++++++++++----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
index 9f702c4fef..b58db8e011 100644
--- a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
+++ b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
@@ -130,7 +130,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList (
//
// Get the first character from the format string
//
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
while (FormatCharacter != 0) {
if (FormatCharacter == '%') {
@@ -148,7 +148,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList (
//
// Get the next character from the format string
//
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
switch (FormatCharacter) {
case '.':
@@ -239,7 +239,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList (
//
// Get the next character from the format string
//
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
}
return TRUE;
}
@@ -1596,7 +1596,7 @@ InternalPrintLibSPrintMarker (
//
// Get the first character from the format string
//
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
//
// Loop until the end of the format string is reached or the output buffer is full
@@ -1628,7 +1628,7 @@ InternalPrintLibSPrintMarker (
//
for (Done = FALSE; !Done; ) {
Format += BytesPerFormatCharacter;
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
switch (FormatCharacter) {
case '.':
Flags |= PRECISION;
@@ -1681,7 +1681,7 @@ InternalPrintLibSPrintMarker (
for (Count = 0; ((FormatCharacter >= '0') && (FormatCharacter <= '9')); ){
Count = (Count * 10) + FormatCharacter - '0';
Format += BytesPerFormatCharacter;
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
}
Format -= BytesPerFormatCharacter;
if ((Flags & PRECISION) == 0) {
@@ -1960,7 +1960,7 @@ InternalPrintLibSPrintMarker (
case '\r':
Format += BytesPerFormatCharacter;
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
if (FormatCharacter == '\n') {
//
// Translate '\r\n' to '\r\n'
@@ -1981,7 +1981,7 @@ InternalPrintLibSPrintMarker (
//
ArgumentString = "\r\n";
Format += BytesPerFormatCharacter;
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
if (FormatCharacter != '\r') {
Format -= BytesPerFormatCharacter;
}
@@ -2000,7 +2000,7 @@ InternalPrintLibSPrintMarker (
case '\r':
Format += BytesPerFormatCharacter;
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
if (FormatCharacter == '\n') {
//
// Translate '\r\n' to '\r\n'
@@ -2021,7 +2021,7 @@ InternalPrintLibSPrintMarker (
//
ArgumentString = "\r\n";
Format += BytesPerFormatCharacter;
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
if (FormatCharacter != '\r') {
Format -= BytesPerFormatCharacter;
}
@@ -2149,7 +2149,7 @@ InternalPrintLibSPrintMarker (
//
// Get the next character from the format string
//
- FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
+ FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
}
if ((Flags & COUNT_ONLY_NO_PRINT) != 0) {
--
2.12.0.windows.1
next prev parent reply other threads:[~2017-05-31 6:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-31 6:13 [PATCH v2 0/2] Avoid reading undefined contents in PrintLib Hao Wu
2017-05-31 6:13 ` [PATCH v2 1/2] MdePkg/BasePrintLib: Avoid reading content beyond the format string Hao Wu
2017-05-31 6:13 ` Hao Wu [this message]
2017-05-31 7:05 ` [PATCH v2 0/2] Avoid reading undefined contents in PrintLib Gao, Liming
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170531061319.21976-3-hao.a.wu@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox