From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 4D1FE2095BB65 for ; Tue, 19 Sep 2017 07:52:29 -0700 (PDT) Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Sep 2017 07:55:34 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.42,418,1500966000"; d="scan'208";a="901858175" Received: from fmsmsx106.amr.corp.intel.com ([10.18.124.204]) by FMSMGA003.fm.intel.com with ESMTP; 19 Sep 2017 07:55:33 -0700 Received: from fmsmsx124.amr.corp.intel.com (10.18.125.39) by FMSMSX106.amr.corp.intel.com (10.18.124.204) with Microsoft SMTP Server (TLS) id 14.3.319.2; Tue, 19 Sep 2017 07:55:33 -0700 Received: from shsmsx101.ccr.corp.intel.com (10.239.4.153) by fmsmsx124.amr.corp.intel.com (10.18.125.39) with Microsoft SMTP Server (TLS) id 14.3.319.2; Tue, 19 Sep 2017 07:55:33 -0700 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.213]) by SHSMSX101.ccr.corp.intel.com ([169.254.1.159]) with mapi id 14.03.0319.002; Tue, 19 Sep 2017 22:55:31 +0800 From: "Ni, Ruiyu" To: "Wu, Hao A" , "edk2-devel@lists.01.org" CC: "Wu, Hao A" , "Kinney, Michael D" , "Gao, Liming" Thread-Topic: [edk2] [PATCH 2/2] MdePkg/BaseLib: Avoid reading content beyond string boundary Thread-Index: AQHTMTvfxeO4LaKupUqPjop26e34YaK8S8ow Date: Tue, 19 Sep 2017 14:55:30 +0000 Deferred-Delivery: Tue, 19 Sep 2017 14:55:00 +0000 Message-ID: <734D49CCEBEEF84792F5B80ED585239D5BA5FB5D@SHSMSX103.ccr.corp.intel.com> References: <20170919113833.14048-1-hao.a.wu@intel.com> <20170919113833.14048-3-hao.a.wu@intel.com> In-Reply-To: <20170919113833.14048-3-hao.a.wu@intel.com> Accept-Language: en-US, zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH 2/2] MdePkg/BaseLib: Avoid reading content beyond string boundary X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Sep 2017 14:52:29 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Ruiyu Ni -----Original Message----- From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Hao = Wu Sent: Tuesday, September 19, 2017 7:39 PM To: edk2-devel@lists.01.org Cc: Wu, Hao A ; Ni, Ruiyu ; Kinney,= Michael D ; Gao, Liming Subject: [edk2] [PATCH 2/2] MdePkg/BaseLib: Avoid reading content beyond st= ring boundary REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D705 As mentioned in the above Bugzilla link by Steven, within the function Path= CleanUpDirectories(), when executing command: "cd ." under Shell, the input parameter 'Path' string will have string length less= than 2. Hence, it is possible for the below statement: "if (StrCmp (Path + StrLen (Path) - 2, L"\\.") =3D=3D 0) {" to read contents before the string boundary. This commit adds additional checks to avoid this. Cc: Ruiyu Ni Cc: Steven Shi Cc: Michael Kinney Cc: Liming Gao Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu --- MdePkg/Library/BaseLib/FilePaths.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MdePkg/Library/BaseLib/FilePaths.c b/MdePkg/Library/BaseLib/Fi= lePaths.c index 203045ccdc..d6f3758ecb 100644 --- a/MdePkg/Library/BaseLib/FilePaths.c +++ b/MdePkg/Library/BaseLib/FilePaths.c @@ -1,7 +1,7 @@ /** @file Defines file-path manipulation functions. =20 - Copyright (c) 2011 - 2016, Intel Corporation. All rights reserved.
+ Copyright (c) 2011 - 2017, Intel Corporation. All rights=20 + reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BS= D License which accompanies this distribution. The full text of the license may b= e found at @@ -91,7 +91,7 @@ PathCleanUpDirectories( while ((TempString =3D StrStr (Path, L"\\.\\")) !=3D NULL) { CopyMem (TempString, TempString + 2, StrSize (TempString + 2)); } - if (StrCmp (Path + StrLen (Path) - 2, L"\\.") =3D=3D 0) { + if ((StrLen (Path) >=3D 2) && (StrCmp (Path + StrLen (Path) - 2,=20 + L"\\.") =3D=3D 0)) { Path[StrLen (Path) - 1] =3D CHAR_NULL; } =20 -- 2.12.0.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel