From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.31, mailfrom: zhichao.gao@intel.com) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by groups.io with SMTP; Fri, 26 Jul 2019 00:46:49 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Jul 2019 00:46:49 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,310,1559545200"; d="scan'208";a="164497454" Received: from fmsmsx108.amr.corp.intel.com ([10.18.124.206]) by orsmga008.jf.intel.com with ESMTP; 26 Jul 2019 00:46:48 -0700 Received: from fmsmsx102.amr.corp.intel.com (10.18.124.200) by FMSMSX108.amr.corp.intel.com (10.18.124.206) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 26 Jul 2019 00:46:47 -0700 Received: from shsmsx107.ccr.corp.intel.com (10.239.4.96) by FMSMSX102.amr.corp.intel.com (10.18.124.200) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 26 Jul 2019 00:46:47 -0700 Received: from shsmsx101.ccr.corp.intel.com ([169.254.1.80]) by SHSMSX107.ccr.corp.intel.com ([169.254.9.65]) with mapi id 14.03.0439.000; Fri, 26 Jul 2019 15:46:44 +0800 From: "Gao, Zhichao" To: "devel@edk2.groups.io" CC: "Carsey, Jaben" , "Ni, Ray" , Andrew Fish Subject: FW: [edk2-devel] [PATCH V2] ShellPkg/UefiHandleParsingLib: Fix incorrect reallocate pool Thread-Topic: [edk2-devel] [PATCH V2] ShellPkg/UefiHandleParsingLib: Fix incorrect reallocate pool Thread-Index: AQHVQFrgGSxL3Rd2xk+XkyYQC0+UvKbci4Xg Date: Fri, 26 Jul 2019 07:46:43 +0000 Message-ID: <3CE959C139B4C44DBEA1810E3AA6F9000B817D47@SHSMSX101.ccr.corp.intel.com> References: <20190722065756.18856-1-zhichao.gao@intel.com> <15B3A870E6EA7BDB.7925@groups.io> In-Reply-To: <15B3A870E6EA7BDB.7925@groups.io> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: zhichao.gao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Ping. Please help to review it. Thanks, Zhichao -----Original Message----- From: devel@edk2.groups.io [mailto:devel@edk2.groups.io] On Behalf Of Gao,= Zhichao Sent: Monday, July 22, 2019 2:58 PM To: devel@edk2.groups.io Cc: Carsey, Jaben ; Ni, Ray ; An= drew Fish Subject: [edk2-devel] [PATCH V2] ShellPkg/UefiHandleParsingLib: Fix incorr= ect reallocate pool REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1965 For function InsertNewGuidNameMapping, it rellocate the mGuidList with new= size "mGuidListCount+1 * sizeof(GUID_INFO_BLOCK)". That isn't its purpose and w= ould cause a overflow operation in "mGuidList[mGuidListCount - 1].xxx =3D x= xx". Its purpose is to increase 1 block size of mGuidList. Change it to "(m= GuidListCount + 1) * sizeof (GUID_INFO_BLOCK)". Adjust the coding style of this function. Cc: Jaben Carsey Cc: Ray Ni Cc: Andrew Fish Signed-off-by: Zhichao Gao --- V2: Update the copyright. .../UefiHandleParsingLib/UefiHandleParsingLib.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/ShellPkg/Library/UefiHandleParsingLib/UefiHandleParsingLib.c = b/ShellPkg/Library/UefiHandleParsingLib/UefiHandleParsingLib.c index f179c41092..43c19b9a91 100644 --- a/ShellPkg/Library/UefiHandleParsingLib/UefiHandleParsingLib.c +++ b/ShellPkg/Library/UefiHandleParsingLib/UefiHandleParsingLib.c @@ -1,7 +1,7 @@ /** @file Provides interface to advanced shell functionality for parsing both han= dle and protocol database. =20 - Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
+ Copyright (c) 2010 - 2019, Intel Corporation. All rights=20 + reserved.
(C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.
(C) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
SPDX-License-Identifier: BSD-2-Clause-Patent @@ -2462,17 +2462,21 @@ In= sertNewGuidNameMapping( IN CONST DUMP_PROTOCOL_INFO DumpFunc OPTIONAL ) { - ASSERT(Guid !=3D NULL); - ASSERT(NameID !=3D 0); + ASSERT (Guid !=3D NULL); + ASSERT (NameID !=3D 0); =20 - mGuidList =3D ReallocatePool(mGuidListCount * sizeof(GUID_INFO_BLOCK), = mGuidListCount+1 * sizeof(GUID_INFO_BLOCK), mGuidList); + mGuidList =3D ReallocatePool ( + mGuidListCount * sizeof (GUID_INFO_BLOCK), + (mGuidListCount + 1) * sizeof (GUID_INFO_BLOCK), + mGuidList + ); if (mGuidList =3D=3D NULL) { mGuidListCount =3D 0; return (EFI_OUT_OF_RESOURCES); } mGuidListCount++; =20 - mGuidList[mGuidListCount - 1].GuidId =3D AllocateCopyPool(sizeof(EFI_= GUID), Guid); + mGuidList[mGuidListCount - 1].GuidId =3D AllocateCopyPool (sizeof (EF= I_GUID), Guid); mGuidList[mGuidListCount - 1].StringId =3D NameID; mGuidList[mGuidListCount - 1].DumpInfo =3D DumpFunc; =20 -- 2.21.0.windows.1