From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from thoth.sbs.de (thoth.sbs.de [192.35.17.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 6263381FAE for ; Thu, 26 Jan 2017 01:00:50 -0800 (PST) Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by thoth.sbs.de (8.15.2/8.15.2) with ESMTPS id v0Q90jGB015214 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 26 Jan 2017 10:00:45 +0100 Received: from DEFTHW99ERJMSX.ww902.siemens.net (defthw99erjmsx.ww902.siemens.net [139.22.70.135]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTPS id v0Q90i6t021630 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 26 Jan 2017 10:00:44 +0100 Received: from DEFTHW99ERCMSX.ww902.siemens.net (139.22.70.70) by DEFTHW99ERJMSX.ww902.siemens.net (139.22.70.135) with Microsoft SMTP Server (TLS) id 14.3.339.0; Thu, 26 Jan 2017 10:00:44 +0100 Received: from DEFTHW99EK3MSX.ww902.siemens.net ([169.254.4.42]) by DEFTHW99ERCMSX.ww902.siemens.net ([139.22.70.70]) with mapi id 14.03.0339.000; Thu, 26 Jan 2017 10:00:43 +0100 From: "Witt, Sebastian" To: "Carsey, Jaben" , "edk2-devel@lists.01.org" Thread-Topic: [PATCH] Fix edit on screens with more than 200 columns Thread-Index: AdJ2ODiu1mdD8bRPQUiM1SL7j7EOggACzgCQAAbPCjAAAIdv4AAB3u+wAFJSmmA= Date: Thu, 26 Jan 2017 09:00:42 +0000 Message-ID: <5964EF557D87964BB107B86316EE26D21E0F7B8D@DEFTHW99EK3MSX.ww902.siemens.net> References: <5964EF557D87964BB107B86316EE26D21E0F4BB8@DEFTHW99EK3MSX.ww902.siemens.net> <5964EF557D87964BB107B86316EE26D21E0F4EA0@DEFTHW99EK3MSX.ww902.siemens.net> In-Reply-To: Accept-Language: de-DE, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [139.22.70.10] MIME-Version: 1.0 Subject: Re: [PATCH] Fix edit on screens with more than 200 columns X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2017 09:00:50 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Like this? If the shell edit command is used on a screen with more than 200 columns, we get a buffer overflow. This always allocates a pool for the= columns. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Sebastian Witt --- .../UefiShellDebug1CommandsLib.c | 15 +++++++++++= +++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1Com= mandsLib.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1Com= mandsLib.c index 6ebf002..d81dd01 100644 --- a/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1CommandsLi= b.c +++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1CommandsLi= b.c @@ -302,12 +302,21 @@ EditorClearLine ( IN UINTN LastRow ) { - CHAR16 Line[200]; + CHAR16 *Line; =20 if (Row =3D=3D 0) { Row =3D 1; } =20 + // Allocate buffer for columns + Line =3D AllocateZeroPool (LastCol*(sizeof(CHAR16) + 1)); + if (Line =3D=3D NULL) { + return; + } + =20 // // prepare a blank line // @@ -326,6 +335,10 @@ EditorClearLine ( // print out the blank line // ShellPrintEx (0, ((INT32)Row) - 1, Line); + =20 + FreePool (Line); } =20 /** --=20 2.1.4 -----Original Message----- From: Carsey, Jaben [mailto:jaben.carsey@intel.com]=20 Sent: Dienstag, 24. Januar 2017 18:36 To: Witt, Sebastian (DF FA AS DH KHE 1); edk2-devel@lists.01.org Cc: Carsey, Jaben Subject: RE: [PATCH] Fix edit on screens with more than 200 columns I didn't mean a 400 static, I meant start by allocating 400 and simplify th= e end of the function... > -----Original Message----- > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of=20 > Witt, Sebastian > Sent: Tuesday, January 24, 2017 8:48 AM > To: Carsey, Jaben ; edk2-devel@lists.01.org > Subject: Re: [edk2] [PATCH] Fix edit on screens with more than 200=20 > columns > Importance: High >=20 > Only performance. But I haven't measured if there is a big difference=20 > between static buffer and AllocateZeroPool. I wouldn't use a fixed value. > There may be a display device with more than 400 columns. Otherwise=20 > one can always allocate the [LastCol + 1] buffer. >=20 > -----Original Message----- > From: Carsey, Jaben [mailto:jaben.carsey@intel.com] > Sent: Dienstag, 24. Januar 2017 17:27 > To: Witt, Sebastian (DF FA AS DH KHE 1); edk2-devel@lists.01.org > Cc: Carsey, Jaben > Subject: RE: [PATCH] Fix edit on screens with more than 200 columns >=20 > Is there a reason to not just always start with allocating the 400 and=20 > then we don't need to complicate the end to conditionally free the buffer= ? >=20 > > -----Original Message----- > > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf=20 > > Of Witt, Sebastian > > Sent: Tuesday, January 24, 2017 5:14 AM > > To: edk2-devel@lists.01.org > > Subject: [edk2] [PATCH] Fix edit on screens with more than 200=20 > > columns > > Importance: High > > > > If the shell edit command is used on a screen with more than > > 200 columns, we get a buffer overflow. This increases the default=20 > > buffer size to > > 400 columns and allocates a pool when this is not enough. > > > > Contributed-under: TianoCore Contribution Agreement 1.0 > > Signed-off-by: Sebastian Witt > > > > --- > > .../UefiShellDebug1CommandsLib.c | 15 +++++++= +++++++- > > 1 file changed, 14 insertions(+), 1 deletion(-) > > > > diff --git > > > a/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1Comman > dsL > > i > > b.c > > > b/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1Comman > dsL > > i > > b.c > > index 6ebf002..d81dd01 100644 > > --- > > > a/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1Comman > dsL > > i > > b.c > > +++ > > > b/ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1Comman > d > > +++ sLib.c > > @@ -302,12 +302,21 @@ EditorClearLine ( > > IN UINTN LastRow > > ) > > { > > - CHAR16 Line[200]; > > + CHAR16 Buffer[400]; > > + CHAR16 *Line =3D Buffer; > > > > if (Row =3D=3D 0) { > > Row =3D 1; > > } > > > > + // If there are more columns than our buffer can contain,=20 > > + allocate new buffer if (LastCol >=3D (sizeof (Buffer) / sizeof (CHAR= 16))) { > > + Line =3D AllocateZeroPool (LastCol*(sizeof(CHAR16) + 1)); > > + if (Line =3D=3D NULL) { > > + return; > > + } > > + } > > + > > // > > // prepare a blank line > > // > > @@ -326,6 +335,10 @@ EditorClearLine ( > > // print out the blank line > > // > > ShellPrintEx (0, ((INT32)Row) - 1, Line); > > + > > + // Free if allocated > > + if (Line !=3D Buffer) > > + FreePool (Line); > > } > > > > /** > > -- > > 2.1.4 > > > > With best regards, > > Sebastian Witt > > > > Siemens AG > > Digital Factory Division > > Factory Automation > > Automation Products and Systems > > DF FA AS DH KHE 1 > > Oestliche Rheinbrueckenstr. 50 > > 76187 Karlsruhe, Germany > > Tel.: +49 721 595-5326 > > mailto:sebastian.witt@siemens.com > > > > www.siemens.com/ingenuityforlife > > > > Siemens Aktiengesellschaft: Chairman of the Supervisory Board:=20 > > Gerhard Cromme; Managing Board: Joe Kaeser, Chairman, President and=20 > > Chief Executive Officer; Roland Busch, Lisa Davis, Klaus Helmrich,=20 > > Janina Kugel, Siegfried Russwurm, Ralf P. Thomas; Registered=20 > > offices: Berlin and Munich, Germany; Commercial registries: Berlin=20 > > Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE=20 > > 23691322 _______________________________________________ > > edk2-devel mailing list > > edk2-devel@lists.01.org > > https://lists.01.org/mailman/listinfo/edk2-devel > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel