From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.43; helo=mga05.intel.com; envelope-from=hao.a.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 559B12035BA2E for ; Mon, 18 Dec 2017 19:24:46 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Dec 2017 19:29:32 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,424,1508828400"; d="scan'208";a="188196727" Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.10]) by fmsmga006.fm.intel.com with ESMTP; 18 Dec 2017 19:29:31 -0800 From: Hao Wu To: edk2-devel@lists.01.org Cc: Hao Wu , Liming Gao , Yonghong Zhu Date: Tue, 19 Dec 2017 11:29:05 +0800 Message-Id: <20171219032912.14404-11-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20171219032912.14404-1-hao.a.wu@intel.com> References: <20171219032912.14404-1-hao.a.wu@intel.com> Subject: [PATCH 10/17] BaseTools/GenBootSector: Add/refine boundary checks for strcpy/strcat X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 03:24:46 -0000 Add checks to ensure when the destination string buffer is of fixed size, the strcpy/strcat functions calls will not access beyond the boundary. Cc: Liming Gao Cc: Yonghong Zhu Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu --- BaseTools/Source/C/GenBootSector/GenBootSector.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/BaseTools/Source/C/GenBootSector/GenBootSector.c b/BaseTools/Source/C/GenBootSector/GenBootSector.c index 3908c589af..c02de49ba2 100644 --- a/BaseTools/Source/C/GenBootSector/GenBootSector.c +++ b/BaseTools/Source/C/GenBootSector/GenBootSector.c @@ -4,7 +4,7 @@ Reading/writing MBR/DBR. If we write MBR to disk, we just update the MBR code and the partition table wouldn't be over written. If we process DBR, we will patch MBR to set first partition active if no active partition exists. -Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.
+Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -631,6 +631,14 @@ GetPathInfo ( return ErrorSuccess; } + // + // Check the path length + // + if (strlen (PathInfo->Path) >= (sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]))) { + fprintf (stderr, "ERROR, Path is too long for - %s", PathInfo->Path); + return ErrorPath; + } + PathInfo->Type = PathFile; if (PathInfo->Input) { // @@ -644,7 +652,12 @@ GetPathInfo ( fclose (f); } PathInfo->Type = PathFile; - strcpy(PathInfo->PhysicalPath, PathInfo->Path); + strncpy( + PathInfo->PhysicalPath, + PathInfo->Path, + sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]) - 1 + ); + PathInfo->PhysicalPath[sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]) - 1] = 0; return ErrorSuccess; } -- 2.12.0.windows.1