From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=fail (domain: intel.com, ip: , mailfrom: zhichao.gao@intel.com) Received: from mga05.intel.com (mga05.intel.com []) by groups.io with SMTP; Mon, 15 Jul 2019 00:31:01 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Jul 2019 00:31:01 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,493,1557212400"; d="scan'208";a="187064424" Received: from fieedk001.ccr.corp.intel.com ([10.239.33.119]) by fmsmga001.fm.intel.com with ESMTP; 15 Jul 2019 00:31:00 -0700 From: "Gao, Zhichao" To: devel@edk2.groups.io Cc: Jaben Carsey , Ray Ni , Andrew Fish Subject: [PATCH] ShellPkg/UefiHandleParsingLib: Fix error allocate pool Date: Mon, 15 Jul 2019 15:30:06 +0800 Message-Id: <20190715073007.25732-3-zhichao.gao@intel.com> X-Mailer: git-send-email 2.21.0.windows.1 In-Reply-To: <20190715073007.25732-1-zhichao.gao@intel.com> References: <20190715073007.25732-1-zhichao.gao@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1965 For function InsertNewGuidNameMapping, it rellocate the mGuidList with new size "mGuidListCount+1 * sizeof(GUID_INFO_BLOCK)". That isn't its purpose and would cause a overflow operation in "mGuidList[mGuidListCount - 1].xxx = xxx". Its purpose is to increase 1 block size of mGuidList. Change it to "(mGuidListCount + 1) * sizeof (GUID_INFO_BLOCK)". Adjust the coding style of this function. Cc: Jaben Carsey Cc: Ray Ni Cc: Andrew Fish Signed-off-by: Zhichao Gao --- .../UefiHandleParsingLib/UefiHandleParsingLib.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/ShellPkg/Library/UefiHandleParsingLib/UefiHandleParsingLib.c b/ShellPkg/Library/UefiHandleParsingLib/UefiHandleParsingLib.c index f179c41092..430c0ee70b 100644 --- a/ShellPkg/Library/UefiHandleParsingLib/UefiHandleParsingLib.c +++ b/ShellPkg/Library/UefiHandleParsingLib/UefiHandleParsingLib.c @@ -2462,17 +2462,21 @@ InsertNewGuidNameMapping( IN CONST DUMP_PROTOCOL_INFO DumpFunc OPTIONAL ) { - ASSERT(Guid != NULL); - ASSERT(NameID != 0); + ASSERT (Guid != NULL); + ASSERT (NameID != 0); - mGuidList = ReallocatePool(mGuidListCount * sizeof(GUID_INFO_BLOCK), mGuidListCount+1 * sizeof(GUID_INFO_BLOCK), mGuidList); + mGuidList = ReallocatePool ( + mGuidListCount * sizeof (GUID_INFO_BLOCK), + (mGuidListCount + 1) * sizeof (GUID_INFO_BLOCK), + mGuidList + ); if (mGuidList == NULL) { mGuidListCount = 0; return (EFI_OUT_OF_RESOURCES); } mGuidListCount++; - mGuidList[mGuidListCount - 1].GuidId = AllocateCopyPool(sizeof(EFI_GUID), Guid); + mGuidList[mGuidListCount - 1].GuidId = AllocateCopyPool (sizeof (EFI_GUID), Guid); mGuidList[mGuidListCount - 1].StringId = NameID; mGuidList[mGuidListCount - 1].DumpInfo = DumpFunc; -- 2.21.0.windows.1