[PATCH v2 0/2] Fix error in PrintLib

[PATCH v2 0/2] Fix error in PrintLib

[Jian J Wang]

> v2:
>    a. Correct incorrect description in commit log
>    b. Fix another similar issue in the same function
>    c. Fix similar issues in MdeModulePkg/DxePrintLibPrint2Protocol

Due to a potential hole in the stop condition of the loop, the two continuous
access to ArgumentString (index, index+1) inside the loop might cause the
string ending character ('\0') and the byte after it to be read.

Jian J Wang (2):
  MdePkg/BasePrintLib: Fix error in Precision position calculation
  MdeModulePkg/DxePrintLibPrint2Protocol: Fix potential string over read

 MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c | 7 +++++--
 MdePkg/Library/BasePrintLib/PrintLibInternal.c            | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

-- 
2.15.1.windows.2

[PATCH v2 1/2] MdePkg/BasePrintLib: Fix error in Precision position calculation

[Jian J Wang]

> v2:
>    a. Correct incorrect description in commit log
>    b. Fix another similar issue in the same function

Due to a potential hole in the stop condition of loop, the two continuous
access to ArgumentString (index, index+1) inside the loop might cause the
string ending character ('\0') and the byte after it to be read.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
---
 MdePkg/Library/BasePrintLib/PrintLibInternal.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
index 28d946472f..fc57255068 100644
--- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
+++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
@@ -1107,7 +1107,10 @@ BasePrintLibSPrintMarker (
       // Compute the number of characters in ArgumentString and store it in Count
       // ArgumentString is either null-terminated, or it contains Precision characters
       //
-      for (Count = 0; Count < Precision || ((Flags & PRECISION) == 0); Count++) {
+      for (Count = 0;
+            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
+            (Count < Precision || ((Flags & PRECISION) == 0));
+              Count++) {
         ArgumentCharacter = ((ArgumentString[Count * BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count * BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
         if (ArgumentCharacter == 0) {
           break;
@@ -1164,7 +1167,7 @@ BasePrintLibSPrintMarker (
     //
     // Copy the string into the output buffer performing the required type conversions
     //
-    while (Index < Count) {
+    while (Index < Count && (*ArgumentString) != '\0') {
       ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
 
       LengthToReturn += (1 * BytesPerOutputCharacter);
-- 
2.15.1.windows.2

[PATCH v2 2/2] MdeModulePkg/DxePrintLibPrint2Protocol: Fix potential string over read

[Jian J Wang]

> v2:
>    Add in v2

Due to a potential hole in the stop condition of loop, the two continuous
access to ArgumentString (index, index+1) inside the loop might cause the
string ending character ('\0') and the byte after it to be read.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
---
 MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
index 56534e56c3..570d06d82e 100644
--- a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
+++ b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
@@ -2050,7 +2050,10 @@ InternalPrintLibSPrintMarker (
       // Compute the number of characters in ArgumentString and store it in Count
       // ArgumentString is either null-terminated, or it contains Precision characters
       //
-      for (Count = 0; Count < Precision || ((Flags & PRECISION) == 0); Count++) {
+      for (Count = 0;
+            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
+            Count < Precision || ((Flags & PRECISION) == 0);
+            Count++) {
         ArgumentCharacter = ((ArgumentString[Count * BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count * BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
         if (ArgumentCharacter == 0) {
           break;
@@ -2107,7 +2110,7 @@ InternalPrintLibSPrintMarker (
     //
     // Copy the string into the output buffer performing the required type conversions
     //
-    while (Index < Count) {
+    while (Index < Count && (*ArgumentString) != '\0') {
       ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
 
       LengthToReturn += (1 * BytesPerOutputCharacter);
-- 
2.15.1.windows.2

Re: [PATCH v2 0/2] Fix error in PrintLib

[Gao, Liming]

Reviewed-by: Liming Gao <liming.gao@intel.com>

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Jian J Wang
> Sent: Thursday, December 28, 2017 10:38 AM
> To: edk2-devel@lists.01.org
> Subject: [edk2] [PATCH v2 0/2] Fix error in PrintLib
> 
> > v2:
> >    a. Correct incorrect description in commit log
> >    b. Fix another similar issue in the same function
> >    c. Fix similar issues in MdeModulePkg/DxePrintLibPrint2Protocol
> 
> Due to a potential hole in the stop condition of the loop, the two continuous
> access to ArgumentString (index, index+1) inside the loop might cause the
> string ending character ('\0') and the byte after it to be read.
> 
> Jian J Wang (2):
>   MdePkg/BasePrintLib: Fix error in Precision position calculation
>   MdeModulePkg/DxePrintLibPrint2Protocol: Fix potential string over read
> 
>  MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c | 7 +++++--
>  MdePkg/Library/BasePrintLib/PrintLibInternal.c            | 7 +++++--
>  2 files changed, 10 insertions(+), 4 deletions(-)
> 
> --
> 2.15.1.windows.2
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: [PATCH v2 0/2] Fix error in PrintLib

[Zeng, Star]

Reviewed-by: Star Zeng <star.zeng@intel.com>

Thanks,
Star
-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Jian J Wang
Sent: Thursday, December 28, 2017 10:38 AM
To: edk2-devel@lists.01.org
Subject: [edk2] [PATCH v2 0/2] Fix error in PrintLib

> v2:
>    a. Correct incorrect description in commit log
>    b. Fix another similar issue in the same function
>    c. Fix similar issues in MdeModulePkg/DxePrintLibPrint2Protocol

Due to a potential hole in the stop condition of the loop, the two continuous access to ArgumentString (index, index+1) inside the loop might cause the string ending character ('\0') and the byte after it to be read.

Jian J Wang (2):
  MdePkg/BasePrintLib: Fix error in Precision position calculation
  MdeModulePkg/DxePrintLibPrint2Protocol: Fix potential string over read

 MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c | 7 +++++--
 MdePkg/Library/BasePrintLib/PrintLibInternal.c            | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

--
2.15.1.windows.2

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [PATCH v2 0/2] Fix error in PrintLib

[Kinney, Michael D]

Jian,

This change breaks GCC5 builds.

/home/mdkinney/tianocore/edk2/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c: In function 'InternalPrintLibSPrintMarker':
/home/mdkinney/tianocore/edk2/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c:2054:71: error: suggest parentheses around '&&' within '||' [-Werror=parentheses]
             ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
             Count < Precision || ((Flags & PRECISION) == 0);
             ~~~~~~~~~~~~~~~~~

Mike

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-
> bounces@lists.01.org] On Behalf Of Jian J Wang
> Sent: Wednesday, December 27, 2017 6:38 PM
> To: edk2-devel@lists.01.org
> Subject: [edk2] [PATCH v2 0/2] Fix error in PrintLib
> 
> > v2:
> >    a. Correct incorrect description in commit log
> >    b. Fix another similar issue in the same function
> >    c. Fix similar issues in
> MdeModulePkg/DxePrintLibPrint2Protocol
> 
> Due to a potential hole in the stop condition of the
> loop, the two continuous
> access to ArgumentString (index, index+1) inside the
> loop might cause the
> string ending character ('\0') and the byte after it to
> be read.
> 
> Jian J Wang (2):
>   MdePkg/BasePrintLib: Fix error in Precision position
> calculation
>   MdeModulePkg/DxePrintLibPrint2Protocol: Fix potential
> string over read
> 
> 
> MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib
> .c | 7 +++++--
>  MdePkg/Library/BasePrintLib/PrintLibInternal.c
> | 7 +++++--
>  2 files changed, 10 insertions(+), 4 deletions(-)
> 
> --
> 2.15.1.windows.2
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: [PATCH v2 0/2] Fix error in PrintLib

[Wang, Jian J]

Mike,

Thanks for catching it. The patch has sent out.

Regards,
Jian


> -----Original Message-----
> From: Kinney, Michael D
> Sent: Friday, December 29, 2017 9:08 AM
> To: Wang, Jian J <jian.j.wang@intel.com>; edk2-devel@lists.01.org; Kinney,
> Michael D <michael.d.kinney@intel.com>
> Subject: RE: [edk2] [PATCH v2 0/2] Fix error in PrintLib
> 
> Jian,
> 
> This change breaks GCC5 builds.
> 
> /home/mdkinney/tianocore/edk2/MdeModulePkg/Library/DxePrintLibPrint2Pro
> tocol/PrintLib.c: In function 'InternalPrintLibSPrintMarker':
> /home/mdkinney/tianocore/edk2/MdeModulePkg/Library/DxePrintLibPrint2Pro
> tocol/PrintLib.c:2054:71: error: suggest parentheses around '&&' within '||' [-
> Werror=parentheses]
>              ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
>              Count < Precision || ((Flags & PRECISION) == 0);
>              ~~~~~~~~~~~~~~~~~
> 
> Mike
> 
> > -----Original Message-----
> > From: edk2-devel [mailto:edk2-devel-
> > bounces@lists.01.org] On Behalf Of Jian J Wang
> > Sent: Wednesday, December 27, 2017 6:38 PM
> > To: edk2-devel@lists.01.org
> > Subject: [edk2] [PATCH v2 0/2] Fix error in PrintLib
> >
> > > v2:
> > >    a. Correct incorrect description in commit log
> > >    b. Fix another similar issue in the same function
> > >    c. Fix similar issues in
> > MdeModulePkg/DxePrintLibPrint2Protocol
> >
> > Due to a potential hole in the stop condition of the
> > loop, the two continuous
> > access to ArgumentString (index, index+1) inside the
> > loop might cause the
> > string ending character ('\0') and the byte after it to
> > be read.
> >
> > Jian J Wang (2):
> >   MdePkg/BasePrintLib: Fix error in Precision position
> > calculation
> >   MdeModulePkg/DxePrintLibPrint2Protocol: Fix potential
> > string over read
> >
> >
> > MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib
> > .c | 7 +++++--
> >  MdePkg/Library/BasePrintLib/PrintLibInternal.c
> > | 7 +++++--
> >  2 files changed, 10 insertions(+), 4 deletions(-)
> >
> > --
> > 2.15.1.windows.2
> >
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel

Re: [PATCH v2 1/2] MdePkg/BasePrintLib: Fix error in Precision position calculation

[Wang, Jian J]

Ard,

Thanks for the fix.

Regards,
Jian

> -----Original Message-----
> From: Ard Biesheuvel [mailto:ard.biesheuvel@linaro.org]
> Sent: Sunday, December 31, 2017 11:57 PM
> To: Wang, Jian J <jian.j.wang@intel.com>
> Cc: edk2-devel@lists.01.org; Kinney, Michael D <michael.d.kinney@intel.com>;
> Yao, Jiewen <jiewen.yao@intel.com>; Zeng, Star <star.zeng@intel.com>; Gao,
> Liming <liming.gao@intel.com>
> Subject: Re: [edk2] [PATCH v2 1/2] MdePkg/BasePrintLib: Fix error in Precision
> position calculation
> 
> On 28 December 2017 at 02:38, Jian J Wang <jian.j.wang@intel.com> wrote:
> >> v2:
> >>    a. Correct incorrect description in commit log
> >>    b. Fix another similar issue in the same function
> >
> > Due to a potential hole in the stop condition of loop, the two continuous
> > access to ArgumentString (index, index+1) inside the loop might cause the
> > string ending character ('\0') and the byte after it to be read.
> >
> > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > Cc: Liming Gao <liming.gao@intel.com>
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > Cc: Star Zeng <star.zeng@intel.com>
> > Contributed-under: TianoCore Contribution Agreement 1.1
> > Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> > ---
> >  MdePkg/Library/BasePrintLib/PrintLibInternal.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> > index 28d946472f..fc57255068 100644
> > --- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> > +++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> > @@ -1107,7 +1107,10 @@ BasePrintLibSPrintMarker (
> >        // Compute the number of characters in ArgumentString and store it in
> Count
> >        // ArgumentString is either null-terminated, or it contains Precision
> characters
> >        //
> > -      for (Count = 0; Count < Precision || ((Flags & PRECISION) == 0); Count++) {
> > +      for (Count = 0;
> > +            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
> > +            (Count < Precision || ((Flags & PRECISION) == 0));
> > +              Count++) {
> >          ArgumentCharacter = ((ArgumentString[Count *
> BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count *
> BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
> >          if (ArgumentCharacter == 0) {
> >            break;
> > @@ -1164,7 +1167,7 @@ BasePrintLibSPrintMarker (
> >      //
> >      // Copy the string into the output buffer performing the required type
> conversions
> >      //
> > -    while (Index < Count) {
> > +    while (Index < Count && (*ArgumentString) != '\0') {
> >        ArgumentCharacter = ((*ArgumentString & 0xff) |
> (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
> >
> >        LengthToReturn += (1 * BytesPerOutputCharacter);
> 
> This patch breaks UEFI menu rendering: the following
> 
> /------------------------------------------------------------------------------\
> |                               Device Manager                                 |
> \------------------------------------------------------------------------------/
> 
> 
> is rendered as
> 
> /\
> |                               Device Manager                                 |
> \/.0                                                 2.00 GHz
> 
> (the spurious digits are SMBIOS data from the home screen)
> 
> The problem appears to be that the CHAR16 value of BOXDRAW_HORIZONTAL
> equals 0x2500, which means that testing ArgumentString[] != '\0'
> (which tests the low byte only) will yield FALSE and terminate the
> loop prematurely.
> 
> The following patch fixes things for me.
> 
> diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> index fc5725506848..3f4be932f369 100644
> --- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> +++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> @@ -1108,7 +1108,9 @@ BasePrintLibSPrintMarker (
>        // ArgumentString is either null-terminated, or it contains
> Precision characters
>        //
>        for (Count = 0;
> -            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
> +            (ArgumentString[Count * BytesPerArgumentCharacter] != '\0' ||
> +             (BytesPerArgumentCharacter > 1 &&
> +              ArgumentString[Count * BytesPerArgumentCharacter + 1]
> != '\0')) &&
>              (Count < Precision || ((Flags & PRECISION) == 0));
>                Count++) {
>          ArgumentCharacter = ((ArgumentString[Count *
> BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count *
> BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
> @@ -1167,7 +1169,9 @@ BasePrintLibSPrintMarker (
>      //
>      // Copy the string into the output buffer performing the required
> type conversions
>      //
> -    while (Index < Count && (*ArgumentString) != '\0') {
> +    while (Index < Count &&
> +           (ArgumentString[0] != '\0' ||
> +            (BytesPerArgumentCharacter > 1 && ArgumentString[1] != '\0'))) {
>        ArgumentCharacter = ((*ArgumentString & 0xff) |
> (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
> 
>        LengthToReturn += (1 * BytesPerOutputCharacter);