Re: [PATCH v1 3/7] FmpDevicePkg/FmpDependencyLib: Handle version string overflow

["Michael D Kinney" <michael.d.kinney@intel.com>]

Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>

> -----Original Message-----
> From: michael.kubacki@outlook.com
> <michael.kubacki@outlook.com>
> Sent: Thursday, July 30, 2020 8:15 PM
> To: devel@edk2.groups.io
> Cc: Gao, Liming <liming.gao@intel.com>; Kinney, Michael
> D <michael.d.kinney@intel.com>
> Subject: [PATCH v1 3/7] FmpDevicePkg/FmpDependencyLib:
> Handle version string overflow
> 
> From: Michael Kubacki <michael.kubacki@microsoft.com>
> 
> This change recognizes the condition of the DEPEX
> version string
> extending beyond the end of the dependency expression as
> an error.
> 
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Signed-off-by: Michael Kubacki
> <michael.kubacki@microsoft.com>
> ---
> 
> Notes:
>     This is particularly helpful for the user to isolate
> the issue
>     when stepping through the control flow as this case
> will be the
>     last executed before jumping to the Error label to
> return from
>     the function.
> 
> 
> FmpDevicePkg/Library/FmpDependencyLib/FmpDependencyLib.c
> | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git
> a/FmpDevicePkg/Library/FmpDependencyLib/FmpDependencyLib
> .c
> b/FmpDevicePkg/Library/FmpDependencyLib/FmpDependencyLib
> .c
> index ba89eb22d9f0..5ef25d2415cf 100644
> ---
> a/FmpDevicePkg/Library/FmpDependencyLib/FmpDependencyLib
> .c
> +++
> b/FmpDevicePkg/Library/FmpDependencyLib/FmpDependencyLib
> .c
> @@ -286,6 +286,7 @@ EvaluateDependency (
>        Iterator += AsciiStrnLenS ((CHAR8 *) Iterator,
> DependenciesSize - (Iterator - Dependencies-
> >Dependencies));
>        if (Iterator == (UINT8 *) Dependencies-
> >Dependencies + DependenciesSize) {
>          DEBUG ((DEBUG_ERROR, "EvaluateDependency:
> STRING extends beyond end of dependency
> expression!\n"));
> +        goto Error;
>        }
>        break;
>      case EFI_FMP_DEP_AND:
> --
> 2.27.0.windows.1