From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 9A58421D046D0 for ; Tue, 19 Sep 2017 04:35:35 -0700 (PDT) Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga105.fm.intel.com with ESMTP; 19 Sep 2017 04:38:40 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.42,418,1500966000"; d="scan'208";a="1173700368" Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by orsmga001.jf.intel.com with ESMTP; 19 Sep 2017 04:38:38 -0700 From: Hao Wu To: edk2-devel@lists.01.org Cc: Hao Wu , Ruiyu Ni , Jaben Carsey , Steven Shi Date: Tue, 19 Sep 2017 19:38:32 +0800 Message-Id: <20170919113833.14048-2-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170919113833.14048-1-hao.a.wu@intel.com> References: <20170919113833.14048-1-hao.a.wu@intel.com> Subject: [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string boundary X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Sep 2017 11:35:35 -0000 REF: https://bugzilla.tianocore.org/show_bug.cgi?id=690 Within function EfiShellGetDevicePathFromFilePath(), when the input parameter 'Path' string is like: "FS0:" It is possible for the below statement: "if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {" to read the content 1 byte beyond the string boundary (both 'Path' and 'MapName' will be FS0: in this case). This commit adds additional checks to avoid this. Cc: Ruiyu Ni Cc: Jaben Carsey Cc: Steven Shi Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu --- ShellPkg/Application/Shell/ShellProtocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c index 40e5e653ae..5e34b8dad1 100644 --- a/ShellPkg/Application/Shell/ShellProtocol.c +++ b/ShellPkg/Application/Shell/ShellProtocol.c @@ -598,7 +598,8 @@ EfiShellGetDevicePathFromFilePath( // // build the full device path // - if (*(Path+StrLen(MapName)+1) == CHAR_NULL) { + if ((*(Path+StrLen(MapName)) != CHAR_NULL) && + (*(Path+StrLen(MapName)+1) == CHAR_NULL)) { DevicePathForReturn = FileDevicePath(Handle, L"\\"); } else { DevicePathForReturn = FileDevicePath(Handle, Path+StrLen(MapName)); -- 2.12.0.windows.1