sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ShellPkg/map: Fix out-of-bound read when "map fsn"

Browse Source 
The below code reads additional one CHAR16 when copying
content from Specific to NewSpecific.
NewSpecific = AllocateCopyPool(
                StrSize(Specific) + sizeof(CHAR16), Specific
                );

The patch fixes this issue.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
This commit is contained in:
Ruiyu Ni
2018-02-05 13:49:32 +08:00
parent 56658c22a6
commit 4887443e4f
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
Main file for map shell level 2 command. Main file for map shell level 2 command.
Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
(C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.<BR> (C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.<BR>
(C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR> (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
@ -222,17 +222,23 @@ MappingListHasType(
{ {
CHAR16 *NewSpecific; CHAR16 *NewSpecific;
RETURN_STATUS Status; RETURN_STATUS Status;
UINTN Length;
// //
// specific has priority // specific has priority
// //
if (Specific != NULL) { if (Specific != NULL) {
NewSpecific = AllocateCopyPool(StrSize(Specific) + sizeof(CHAR16), Specific); Length = StrLen (Specific);
//
// Allocate enough buffer for Specific and potential ":"
//
NewSpecific = AllocatePool ((Length + 2) * sizeof(CHAR16));
if (NewSpecific == NULL){ if (NewSpecific == NULL){
return FALSE; return FALSE;
} }
if (NewSpecific[StrLen(NewSpecific)-1] != L':') { StrCpyS (NewSpecific, Length + 2, Specific);
Status = StrnCatS(NewSpecific, (StrSize(Specific) + sizeof(CHAR16))/sizeof(CHAR16), L":", StrLen(L":")); if (Specific[Length - 1] != L':') {
Status = StrnCatS(NewSpecific, Length + 2, L":", StrLen(L":"));
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
FreePool(NewSpecific); FreePool(NewSpecific);
return FALSE; return FALSE;