public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Carsey, Jaben" <jaben.carsey@intel.com>
To: "Ni, Ruiyu" <ruiyu.ni@intel.com>,
	"edk2-devel@lists.01.org" <edk2-devel@lists.01.org>
Subject: Re: [PATCH] ShellPkg/edit: Fix heap access out-of-bounds
Date: Thu, 16 Aug 2018 14:57:10 +0000	[thread overview]
Message-ID: <CB6E33457884FA40993F35157061515CA411C63A@FMSMSX103.amr.corp.intel.com> (raw)
In-Reply-To: <20180816063323.177852-1-ruiyu.ni@intel.com>

Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>

> -----Original Message-----
> From: Ni, Ruiyu
> Sent: Wednesday, August 15, 2018 11:33 PM
> To: edk2-devel@lists.01.org
> Cc: Carsey, Jaben <jaben.carsey@intel.com>; Wang, Jian J
> <jian.j.wang@intel.com>
> Subject: [PATCH] ShellPkg/edit: Fix heap access out-of-bounds
> Importance: High
> 
> The issue was found when heap guard is turned on.
> PrintLib somehow receives a non-null terminated string in var-arg.
> When the PrintLib implementation reads the string it keeps
> reading because no null-terminator is met, which triggers the page
> fault set by the heap guard.
> 
> The issue is caused by a bug in FileBufferPrintLine().
> When "edit" opens a binary file, in FileBufferPrintLine(),
> the Line->Buffer may start with \x00 \x00, but the Line->Size is
> larger than MainEditor.ScreenSize.Column, it causes the PrintLine is
> set to an empty string by below call:
>     StrnCpyS (
>       PrintLine, BufLen/sizeof(CHAR16), Buffer,
>       MIN(Limit, MainEditor.ScreenSize.Column)
>       );
> But since Limit (equals to Line->Size) is larger than
> MainEditor.ScreenSize.Column, below for-loop doesn't successfully
> set the whole PrintLine to all-empty-space.
>     for (; Limit < MainEditor.ScreenSize.Column; Limit++) {
>       PrintLine[Limit] = L' ';
>     }
> So after the for-loop, PrintLine is still an empty string.
> Later in below call, the PrintLine2 is created based on PrintLine.
>     ShellCopySearchAndReplace (
>       PrintLine, PrintLine2,
>       BufLen * 2, L"%", L"^%", FALSE, FALSE
>       );
> But due to the implementation of ShellCopySearchAndReplace(),
> PrintLine2 is untouched and INVALID_PARAMETER is returned.
> Finally an uninitialized string is passed to ShellPrintEx()
> which causes the #PF exception.
> 
> The fix is to reset Limit to StrLen(PrintLine) before for-loop.
> So that PrintLine can be converted from an empty string to a
> string containing all spaces.
> 
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
> Cc: Jaben Carsey <jaben.carsey@intel.com>
> Cc: Jian Wang <jian.j.wang@intel.com>
> ---
>  ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
> b/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
> index 56ccd399b0..39a5afb53f 100644
> --- a/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
> +++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c
> @@ -500,7 +500,7 @@ FileBufferPrintLine (
>    PrintLine = AllocatePool (BufLen);
>    if (PrintLine != NULL) {
>      StrnCpyS (PrintLine, BufLen/sizeof(CHAR16), Buffer, MIN(Limit,
> MainEditor.ScreenSize.Column));
> -    for (; Limit < MainEditor.ScreenSize.Column; Limit++) {
> +    for (Limit = StrLen (PrintLine); Limit < MainEditor.ScreenSize.Column;
> Limit++) {
>        PrintLine[Limit] = L' ';
>      }
> 
> --
> 2.16.1.windows.1



      parent reply	other threads:[~2018-08-16 14:58 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-08-16  6:33 [PATCH] ShellPkg/edit: Fix heap access out-of-bounds Ruiyu Ni
2018-08-16  7:58 ` Wang, Jian J
2018-08-16 14:57 ` Carsey, Jaben [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CB6E33457884FA40993F35157061515CA411C63A@FMSMSX103.amr.corp.intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox