public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: Hao Wu <hao.a.wu@intel.com>
To: edk2-devel@lists.01.org
Cc: Hao Wu <hao.a.wu@intel.com>, Liming Gao <liming.gao@intel.com>,
	Yonghong Zhu <yonghong.zhu@intel.com>
Subject: [PATCH 12/17] BaseTools/GenVtf: Add/refine boundary checks for strcpy/strcat calls
Date: Tue, 19 Dec 2017 11:29:07 +0800	[thread overview]
Message-ID: <20171219032912.14404-13-hao.a.wu@intel.com> (raw)
In-Reply-To: <20171219032912.14404-1-hao.a.wu@intel.com>

Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
 BaseTools/Source/C/GenVtf/GenVtf.c | 43 ++++++++++++++++++++++++++++++++------
 1 file changed, 37 insertions(+), 6 deletions(-)

diff --git a/BaseTools/Source/C/GenVtf/GenVtf.c b/BaseTools/Source/C/GenVtf/GenVtf.c
index 2ae9a7be2c..65ae08eece 100644
--- a/BaseTools/Source/C/GenVtf/GenVtf.c
+++ b/BaseTools/Source/C/GenVtf/GenVtf.c
@@ -362,10 +362,20 @@ Returns:
       }
     } else if (strnicmp (*TokenStr, "COMP_BIN", 8) == 0) {
       TokenStr++;
-      strcpy (VtfInfo->CompBinName, *TokenStr);
+      if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+        Error (NULL, 0, 3000, "Invalid", "The 'COMP_BIN' name is too long.");
+        return ;
+      }
+      strncpy (VtfInfo->CompBinName, *TokenStr, FILE_NAME_SIZE - 1);
+      VtfInfo->CompBinName[FILE_NAME_SIZE - 1] = 0;
     } else if (strnicmp (*TokenStr, "COMP_SYM", 8) == 0) {
       TokenStr++;
-      strcpy (VtfInfo->CompSymName, *TokenStr);
+      if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+        Error (NULL, 0, 3000, "Invalid", "The 'COMP_SYM' name is too long.");
+        return ;
+      }
+      strncpy (VtfInfo->CompSymName, *TokenStr, FILE_NAME_SIZE - 1);
+      VtfInfo->CompSymName[FILE_NAME_SIZE - 1] = 0;
     } else if (strnicmp (*TokenStr, "COMP_SIZE", 9) == 0) {
       TokenStr++;
       if (strnicmp (*TokenStr, "-", 1) == 0) {
@@ -444,14 +454,24 @@ Returns:
     if (SectionOptionFlag) {
       if (stricmp (*TokenStr, "IA32_RST_BIN") == 0) {
         TokenStr++;
-        strcpy (IA32BinFile, *TokenStr);
+        if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+          Error (NULL, 0, 3000, "Invalid", "The 'IA32_RST_BIN' name is too long.");
+          break;
+        }
+        strncpy (IA32BinFile, *TokenStr, FILE_NAME_SIZE - 1);
+        IA32BinFile[FILE_NAME_SIZE - 1] = 0;
       }
     }
 
     if (SectionCompFlag) {
       if (stricmp (*TokenStr, "COMP_NAME") == 0) {
         TokenStr++;
-        strcpy (FileListPtr->CompName, *TokenStr);
+        if (strlen (*TokenStr) >= COMPONENT_NAME_SIZE) {
+          Error (NULL, 0, 3000, "Invalid", "The 'COMP_NAME' name is too long.");
+          break;
+        }
+        strncpy (FileListPtr->CompName, *TokenStr, COMPONENT_NAME_SIZE - 1);
+        FileListPtr->CompName[COMPONENT_NAME_SIZE - 1] = 0;
         TokenStr++;
         ParseAndUpdateComponents (FileListPtr);
       }
@@ -2240,9 +2260,20 @@ Returns:
   //
   // Use the file name minus extension as the base for tokens
   //
-  strcpy (BaseToken, SourceFileName);
+  if (strlen (SourceFileName) >= MAX_LONG_FILE_PATH) {
+    fclose (SourceFile);
+    Error (NULL, 0, 2000, "Invalid parameter", "The source file name is too long.");
+    return EFI_ABORTED;
+  }
+  strncpy (BaseToken, SourceFileName, MAX_LONG_FILE_PATH - 1);
+  BaseToken[MAX_LONG_FILE_PATH - 1] = 0;
   strtok (BaseToken, ". \t\n");
-  strcat (BaseToken, "__");
+  if (strlen (BaseToken) + strlen ("__") >= MAX_LONG_FILE_PATH) {
+    fclose (SourceFile);
+    Error (NULL, 0, 2000, "Invalid parameter", "The source file name is too long.");
+    return EFI_ABORTED;
+  }
+  strncat (BaseToken, "__", MAX_LONG_FILE_PATH - strlen (BaseToken) - 1);
 
   //
   // Open the destination file
-- 
2.12.0.windows.1



  parent reply	other threads:[~2017-12-19  3:24 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-12-19  3:28 [PATCH 00/17] BaseTools/C: Code refinements Hao Wu
2017-12-19  3:28 ` [PATCH 01/17] BaseTools/C/Common: Add checks for array access Hao Wu
2017-12-19  3:28 ` [PATCH 02/17] BaseTools/EfiRom: Refine the logic in main() Hao Wu
2017-12-19  3:28 ` [PATCH 03/17] BaseTools/LzmaCompress: Fix possible uninitialized variable Hao Wu
2017-12-19  3:28 ` [PATCH 04/17] BaseTools/C/Common: Remove redundant type cast Hao Wu
2017-12-19  3:29 ` [PATCH 05/17] BaseTools/VfrCompile: Assign 'NULL' for closed file handle Hao Wu
2017-12-19  3:29 ` [PATCH 06/17] BaseTools/GenFv: Add check to ensure the file handle status is correct Hao Wu
2017-12-19  3:29 ` [PATCH 07/17] BaseTools/C/Common: Add/refine boundary checks for strcpy/strcat calls Hao Wu
2017-12-19  3:29 ` [PATCH 08/17] BaseTools/C/Common: Refine using sprintf() with '%s' in format string Hao Wu
2017-12-19  3:29 ` [PATCH 09/17] BaseTools/EfiRom: Add/refine boundary checks for strcpy/strcat calls Hao Wu
2017-12-19  3:29 ` [PATCH 10/17] BaseTools/GenBootSector: Add/refine boundary checks for strcpy/strcat Hao Wu
2017-12-19  3:29 ` [PATCH 11/17] BaseTools/GenFv: Add/refine boundary checks for strcpy/strcat calls Hao Wu
2017-12-19  3:29 ` Hao Wu [this message]
2017-12-19  3:29 ` [PATCH 13/17] BaseTools/VfrCompile: Add/refine boundary checks for strcpy/strcat Hao Wu
2017-12-19  3:29 ` [PATCH 14/17] BaseTools/VfrCompile: Resolve uninit class variables in constructor Hao Wu
2017-12-19  3:29 ` [PATCH 15/17] BaseTools/GenFfs: Enlarge the size of 'AlignmentBuffer' Hao Wu
2017-12-19  3:29 ` [PATCH 16/17] BaseTools/GenSec: Fix potential memory leak Hao Wu
2017-12-19  3:29 ` [PATCH 17/17] BaseTools/GenSec: Fix potential null pointer dereference Hao Wu
2017-12-25  1:48 ` [PATCH 00/17] BaseTools/C: Code refinements Gao, Liming

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171219032912.14404-13-hao.a.wu@intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox