From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.20; helo=mga02.intel.com; envelope-from=hao.a.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 8323922603AF4 for ; Wed, 21 Mar 2018 20:04:20 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Mar 2018 20:10:51 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.48,342,1517904000"; d="scan'208";a="210308766" Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.10]) by orsmga005.jf.intel.com with ESMTP; 21 Mar 2018 20:10:50 -0700 From: Hao Wu To: edk2-devel@lists.01.org Cc: Hao Wu , Steven Shi , Michael D Kinney , Liming Gao Date: Thu, 22 Mar 2018 11:10:21 +0800 Message-Id: <20180322031021.10796-1-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 Subject: [PATCH] MdePkg/BaseMemoryLib: Fix undefined behavior for left-shift operation X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Mar 2018 03:04:20 -0000 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=783 Within function InternalMemSetMem(), for line: Value32 = (Value << 24) | (Value << 16) | (Value << 8) | Value; Expression '(Value << 24)' is possible to bring undefined behavior. Since 'Value' is of type UINT8 (unsigned char), it will be implicitly promoted to type 'int' before performing the left-shift operation. It is possible for '(Value << 24)' to exceed the range of type 'int', which may bring undefined behavior. This commit add explicit type cast like: ((UINT32)Value << 24) to resolve the issue. Cc: Steven Shi Cc: Michael D Kinney Cc: Liming Gao Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu --- MdePkg/Library/BaseMemoryLib/SetMem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MdePkg/Library/BaseMemoryLib/SetMem.c b/MdePkg/Library/BaseMemoryLib/SetMem.c index b6fb811c38..124b48fe5d 100644 --- a/MdePkg/Library/BaseMemoryLib/SetMem.c +++ b/MdePkg/Library/BaseMemoryLib/SetMem.c @@ -4,7 +4,7 @@ build for a particular platform easily if an optimized version is desired. - Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.
+ Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.
Copyright (c) 2012 - 2013, ARM Ltd. All rights reserved.
Copyright (c) 2016, Linaro Ltd. All rights reserved.
@@ -54,7 +54,7 @@ InternalMemSetMem ( if ((((UINTN)Buffer & 0x7) == 0) && (Length >= 8)) { // Generate the 64bit value - Value32 = (Value << 24) | (Value << 16) | (Value << 8) | Value; + Value32 = ((UINT32)Value << 24) | (Value << 16) | (Value << 8) | Value; Value64 = LShiftU64 (Value32, 32) | Value32; Pointer64 = (UINT64*)Buffer; -- 2.12.0.windows.1