From: "Ni, Ruiyu" <ruiyu.ni@intel.com>
To: "Wu, Hao A" <hao.a.wu@intel.com>,
"edk2-devel@lists.01.org" <edk2-devel@lists.01.org>
Cc: "Wu, Hao A" <hao.a.wu@intel.com>,
"Carsey, Jaben" <jaben.carsey@intel.com>
Subject: Re: [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string boundary
Date: Tue, 19 Sep 2017 14:55:30 +0000 [thread overview]
Message-ID: <734D49CCEBEEF84792F5B80ED585239D5BA5FB62@SHSMSX103.ccr.corp.intel.com> (raw)
In-Reply-To: <20170919113833.14048-2-hao.a.wu@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Hao Wu
Sent: Tuesday, September 19, 2017 7:39 PM
To: edk2-devel@lists.01.org
Cc: Wu, Hao A <hao.a.wu@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Carsey, Jaben <jaben.carsey@intel.com>
Subject: [edk2] [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string boundary
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=690
Within function EfiShellGetDevicePathFromFilePath(), when the input parameter 'Path' string is like:
"FS0:"
It is possible for the below statement:
"if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {"
to read the content 1 byte beyond the string boundary (both 'Path' and 'MapName' will be FS0: in this case).
This commit adds additional checks to avoid this.
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jaben Carsey <jaben.carsey@intel.com>
Cc: Steven Shi <steven.shi@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
ShellPkg/Application/Shell/ShellProtocol.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c
index 40e5e653ae..5e34b8dad1 100644
--- a/ShellPkg/Application/Shell/ShellProtocol.c
+++ b/ShellPkg/Application/Shell/ShellProtocol.c
@@ -598,7 +598,8 @@ EfiShellGetDevicePathFromFilePath(
//
// build the full device path
//
- if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {
+ if ((*(Path+StrLen(MapName)) != CHAR_NULL) &&
+ (*(Path+StrLen(MapName)+1) == CHAR_NULL)) {
DevicePathForReturn = FileDevicePath(Handle, L"\\");
} else {
DevicePathForReturn = FileDevicePath(Handle, Path+StrLen(MapName));
--
2.12.0.windows.1
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
next prev parent reply other threads:[~2017-09-19 14:52 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-19 11:38 [PATCH 0/2] Avoid consuming content beyond string boundaries Hao Wu
2017-09-19 11:38 ` [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string boundary Hao Wu
2017-09-19 13:22 ` Carsey, Jaben
2017-09-19 14:55 ` Ni, Ruiyu [this message]
2017-09-19 11:38 ` [PATCH 2/2] MdePkg/BaseLib: " Hao Wu
2017-09-19 14:55 ` Ni, Ruiyu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=734D49CCEBEEF84792F5B80ED585239D5BA5FB62@SHSMSX103.ccr.corp.intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox