From: Hao Wu <hao.a.wu@intel.com>
To: edk2-devel@lists.01.org
Cc: Hao Wu <hao.a.wu@intel.com>, Liming Gao <liming.gao@intel.com>,
Yonghong Zhu <yonghong.zhu@intel.com>
Subject: [PATCH 12/17] BaseTools/GenVtf: Add/refine boundary checks for strcpy/strcat calls
Date: Tue, 19 Dec 2017 11:29:07 +0800 [thread overview]
Message-ID: <20171219032912.14404-13-hao.a.wu@intel.com> (raw)
In-Reply-To: <20171219032912.14404-1-hao.a.wu@intel.com>
Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.
Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
BaseTools/Source/C/GenVtf/GenVtf.c | 43 ++++++++++++++++++++++++++++++++------
1 file changed, 37 insertions(+), 6 deletions(-)
diff --git a/BaseTools/Source/C/GenVtf/GenVtf.c b/BaseTools/Source/C/GenVtf/GenVtf.c
index 2ae9a7be2c..65ae08eece 100644
--- a/BaseTools/Source/C/GenVtf/GenVtf.c
+++ b/BaseTools/Source/C/GenVtf/GenVtf.c
@@ -362,10 +362,20 @@ Returns:
}
} else if (strnicmp (*TokenStr, "COMP_BIN", 8) == 0) {
TokenStr++;
- strcpy (VtfInfo->CompBinName, *TokenStr);
+ if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+ Error (NULL, 0, 3000, "Invalid", "The 'COMP_BIN' name is too long.");
+ return ;
+ }
+ strncpy (VtfInfo->CompBinName, *TokenStr, FILE_NAME_SIZE - 1);
+ VtfInfo->CompBinName[FILE_NAME_SIZE - 1] = 0;
} else if (strnicmp (*TokenStr, "COMP_SYM", 8) == 0) {
TokenStr++;
- strcpy (VtfInfo->CompSymName, *TokenStr);
+ if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+ Error (NULL, 0, 3000, "Invalid", "The 'COMP_SYM' name is too long.");
+ return ;
+ }
+ strncpy (VtfInfo->CompSymName, *TokenStr, FILE_NAME_SIZE - 1);
+ VtfInfo->CompSymName[FILE_NAME_SIZE - 1] = 0;
} else if (strnicmp (*TokenStr, "COMP_SIZE", 9) == 0) {
TokenStr++;
if (strnicmp (*TokenStr, "-", 1) == 0) {
@@ -444,14 +454,24 @@ Returns:
if (SectionOptionFlag) {
if (stricmp (*TokenStr, "IA32_RST_BIN") == 0) {
TokenStr++;
- strcpy (IA32BinFile, *TokenStr);
+ if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+ Error (NULL, 0, 3000, "Invalid", "The 'IA32_RST_BIN' name is too long.");
+ break;
+ }
+ strncpy (IA32BinFile, *TokenStr, FILE_NAME_SIZE - 1);
+ IA32BinFile[FILE_NAME_SIZE - 1] = 0;
}
}
if (SectionCompFlag) {
if (stricmp (*TokenStr, "COMP_NAME") == 0) {
TokenStr++;
- strcpy (FileListPtr->CompName, *TokenStr);
+ if (strlen (*TokenStr) >= COMPONENT_NAME_SIZE) {
+ Error (NULL, 0, 3000, "Invalid", "The 'COMP_NAME' name is too long.");
+ break;
+ }
+ strncpy (FileListPtr->CompName, *TokenStr, COMPONENT_NAME_SIZE - 1);
+ FileListPtr->CompName[COMPONENT_NAME_SIZE - 1] = 0;
TokenStr++;
ParseAndUpdateComponents (FileListPtr);
}
@@ -2240,9 +2260,20 @@ Returns:
//
// Use the file name minus extension as the base for tokens
//
- strcpy (BaseToken, SourceFileName);
+ if (strlen (SourceFileName) >= MAX_LONG_FILE_PATH) {
+ fclose (SourceFile);
+ Error (NULL, 0, 2000, "Invalid parameter", "The source file name is too long.");
+ return EFI_ABORTED;
+ }
+ strncpy (BaseToken, SourceFileName, MAX_LONG_FILE_PATH - 1);
+ BaseToken[MAX_LONG_FILE_PATH - 1] = 0;
strtok (BaseToken, ". \t\n");
- strcat (BaseToken, "__");
+ if (strlen (BaseToken) + strlen ("__") >= MAX_LONG_FILE_PATH) {
+ fclose (SourceFile);
+ Error (NULL, 0, 2000, "Invalid parameter", "The source file name is too long.");
+ return EFI_ABORTED;
+ }
+ strncat (BaseToken, "__", MAX_LONG_FILE_PATH - strlen (BaseToken) - 1);
//
// Open the destination file
--
2.12.0.windows.1
next prev parent reply other threads:[~2017-12-19 3:24 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-19 3:28 [PATCH 00/17] BaseTools/C: Code refinements Hao Wu
2017-12-19 3:28 ` [PATCH 01/17] BaseTools/C/Common: Add checks for array access Hao Wu
2017-12-19 3:28 ` [PATCH 02/17] BaseTools/EfiRom: Refine the logic in main() Hao Wu
2017-12-19 3:28 ` [PATCH 03/17] BaseTools/LzmaCompress: Fix possible uninitialized variable Hao Wu
2017-12-19 3:28 ` [PATCH 04/17] BaseTools/C/Common: Remove redundant type cast Hao Wu
2017-12-19 3:29 ` [PATCH 05/17] BaseTools/VfrCompile: Assign 'NULL' for closed file handle Hao Wu
2017-12-19 3:29 ` [PATCH 06/17] BaseTools/GenFv: Add check to ensure the file handle status is correct Hao Wu
2017-12-19 3:29 ` [PATCH 07/17] BaseTools/C/Common: Add/refine boundary checks for strcpy/strcat calls Hao Wu
2017-12-19 3:29 ` [PATCH 08/17] BaseTools/C/Common: Refine using sprintf() with '%s' in format string Hao Wu
2017-12-19 3:29 ` [PATCH 09/17] BaseTools/EfiRom: Add/refine boundary checks for strcpy/strcat calls Hao Wu
2017-12-19 3:29 ` [PATCH 10/17] BaseTools/GenBootSector: Add/refine boundary checks for strcpy/strcat Hao Wu
2017-12-19 3:29 ` [PATCH 11/17] BaseTools/GenFv: Add/refine boundary checks for strcpy/strcat calls Hao Wu
2017-12-19 3:29 ` Hao Wu [this message]
2017-12-19 3:29 ` [PATCH 13/17] BaseTools/VfrCompile: Add/refine boundary checks for strcpy/strcat Hao Wu
2017-12-19 3:29 ` [PATCH 14/17] BaseTools/VfrCompile: Resolve uninit class variables in constructor Hao Wu
2017-12-19 3:29 ` [PATCH 15/17] BaseTools/GenFfs: Enlarge the size of 'AlignmentBuffer' Hao Wu
2017-12-19 3:29 ` [PATCH 16/17] BaseTools/GenSec: Fix potential memory leak Hao Wu
2017-12-19 3:29 ` [PATCH 17/17] BaseTools/GenSec: Fix potential null pointer dereference Hao Wu
2017-12-25 1:48 ` [PATCH 00/17] BaseTools/C: Code refinements Gao, Liming
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171219032912.14404-13-hao.a.wu@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox