Re: [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string boundary

["Carsey, Jaben" <jaben.carsey@intel.com>]

Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>

> -----Original Message-----
> From: Wu, Hao A
> Sent: Tuesday, September 19, 2017 4:39 AM
> To: edk2-devel@lists.01.org
> Cc: Wu, Hao A <hao.a.wu@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>;
> Carsey, Jaben <jaben.carsey@intel.com>; Shi, Steven
> <steven.shi@intel.com>
> Subject: [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string
> boundary
> Importance: High
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=690
> 
> Within function EfiShellGetDevicePathFromFilePath(), when the input
> parameter 'Path' string is like:
> "FS0:"
> 
> It is possible for the below statement:
> "if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {"
> 
> to read the content 1 byte beyond the string boundary (both 'Path' and
> 'MapName' will be FS0: in this case).
> 
> This commit adds additional checks to avoid this.
> 
> Cc: Ruiyu Ni <ruiyu.ni@intel.com>
> Cc: Jaben Carsey <jaben.carsey@intel.com>
> Cc: Steven Shi <steven.shi@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Hao Wu <hao.a.wu@intel.com>
> ---
>  ShellPkg/Application/Shell/ShellProtocol.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/ShellPkg/Application/Shell/ShellProtocol.c
> b/ShellPkg/Application/Shell/ShellProtocol.c
> index 40e5e653ae..5e34b8dad1 100644
> --- a/ShellPkg/Application/Shell/ShellProtocol.c
> +++ b/ShellPkg/Application/Shell/ShellProtocol.c
> @@ -598,7 +598,8 @@ EfiShellGetDevicePathFromFilePath(
>    //
>    // build the full device path
>    //
> -  if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {
> +  if ((*(Path+StrLen(MapName)) != CHAR_NULL) &&
> +      (*(Path+StrLen(MapName)+1) == CHAR_NULL)) {
>      DevicePathForReturn = FileDevicePath(Handle, L"\\");
>    } else {
>      DevicePathForReturn = FileDevicePath(Handle, Path+StrLen(MapName));
> --
> 2.12.0.windows.1