From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from spamsz.greatwall.com.cn (spamsz.greatwall.com.cn [58.60.186.99]) by mx.groups.io with SMTP id smtpd.web12.3073.1610594590115447995 for ; Wed, 13 Jan 2021 19:23:10 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: greatwall.com.cn, ip: 58.60.186.99, mailfrom: gechao@greatwall.com.cn) X-ASG-Debug-ID: 1610594583-0ec5721e7b15760001-xsgHyH Received: from greatwall.com.cn (mailsz01.greatwall.com.cn [10.11.120.1]) by spamsz.greatwall.com.cn with ESMTP id vMIzUpB5RMkcLctZ for ; Thu, 14 Jan 2021 11:23:03 +0800 (CST) X-Barracuda-Envelope-From: gechao@greatwall.com.cn X-Barracuda-RBL-Trusted-Forwarder: 10.11.120.1 Received: from DESKTOP-8UEJ5KU.greatwall.com.cn (unknown [10.11.15.76]) by mailsz.greatwall.com.cn (Coremail) with SMTP id AXgLCgDHzzPUuP9fG_oKAA--.10742S2; Thu, 14 Jan 2021 11:21:56 +0800 (CST) From: "gechao" X-Barracuda-RBL-Trusted-Forwarder: 10.11.15.76 To: zhichao.gao@intel.com Cc: devel@edk2.groups.io, ray.ni@intel.com, gechao Subject: [PATCH] MdeModulePkg/TerminalDxe [BUG]: Terminal fifo buffer overflow. Date: Thu, 14 Jan 2021 11:22:59 +0800 X-ASG-Orig-Subj: [PATCH] MdeModulePkg/TerminalDxe [BUG]: Terminal fifo buffer overflow. Message-Id: X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: AXgLCgDHzzPUuP9fG_oKAA--.10742S2 X-Coremail-Antispam: 1UD129KBjvJXoW7uryxWrW5GFWUXr4xJr43KFg_yoW8Jw4rpr Z8Ga4DJF1DJw45CFyUGF4IqF13K395Ja4fG3Z5ZFnavF13Xw48W34UGrWYkas29r40yr95 Kr47tr4F9w1DJFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkq14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4U JVW0owA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwAKzVCY07xG64k0F24l 42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJV WUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r126r1DMIIYrxkI7VAK I48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r1j6r 4UMIIF0xvE42xK8VAvwI8IcIk0rVWrZr1j6s0DMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF 0xvEx4A2jsIEc7CjxVAFwI0_Jr0_GrUvcSsGvfC2KfnxnUUI43ZEXa7VUjRVbDUUUUU== X-CM-SenderInfo: xjhfxtvr6j2vpdwztz3oof0zgofq/ X-Barracuda-Connect: mailsz01.greatwall.com.cn[10.11.120.1] X-Barracuda-Start-Time: 1610594583 X-Barracuda-URL: https://spamfw.greatwall.com.cn:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at greatwall.com.cn X-Barracuda-Scan-Msg-Size: 1313 X-Barracuda-BRTS-Status: 1 X-Barracuda-Bayes: INNOCENT GLOBAL 0.4842 1.0000 0.0000 X-Barracuda-Spam-Score: 0.00 X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=9.0 tests=BSF_SC0_MISMATCH_TO, NO_REAL_NAME X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.87228 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.00 NO_REAL_NAME From: does not include a real name 0.00 BSF_SC0_MISMATCH_TO Envelope rcpt doesn't match header Content-Transfer-Encoding: quoted-printable From: gechao Fix the bug of terminal fifo buffer overflow with UINT8 type. typedef struct { UINT8 Head; UINT8 Tail; UINT8 Data[RAW_FIFO_MAX_NUMBER + 1]; } RAW_DATA_FIFO; RAW_FIFO_MAX_NUMBER is 256. the data buffer size is 257 (Index from 0 to 256), but the max value of the index, Head or Tail (UINT8), is 255. That means the last data of the data buffer would be always empty if we use Head/Tail to output/input the data correctly. And because of the incorrect buffer size the FIFO full check "((Tail + 1) % (RAW_FIFO_MAX_NUMBER + 1)) =3D=3D Head" would never me= et. Signed-off-by: gechao --- MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h b/MdeMod= ulePkg/Universal/Console/TerminalDxe/Terminal.h index 378ace13ce..360e58e847 100644 --- a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h +++ b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h @@ -37,7 +37,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include =0D =0D =0D -#define RAW_FIFO_MAX_NUMBER 256=0D +#define RAW_FIFO_MAX_NUMBER 255=0D #define FIFO_MAX_NUMBER 128=0D =0D typedef struct {=0D --=20 2.25.1