From 9fdf31789a7088736bc574f6802f4a97b5ef2e97 Mon Sep 17 00:00:00 2001 From: Hao Wu Date: Tue, 19 Sep 2017 11:01:56 +0800 Subject: [PATCH] MdePkg/BaseLib: Avoid reading content beyond string boundary REF: https://bugzilla.tianocore.org/show_bug.cgi?id=705 As mentioned in the above Bugzilla link by Steven, within the function PathCleanUpDirectories(), when executing command: "cd ." under Shell, the input parameter 'Path' string will have string length less than 2. Hence, it is possible for the below statement: "if (StrCmp (Path + StrLen (Path) - 2, L"\\.") == 0) {" to read contents before the string boundary. This commit adds additional checks to avoid this. Cc: Steven Shi Cc: Michael Kinney Cc: Liming Gao Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu Reviewed-by: Ruiyu Ni --- MdePkg/Library/BaseLib/FilePaths.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MdePkg/Library/BaseLib/FilePaths.c b/MdePkg/Library/BaseLib/FilePaths.c index 203045ccdc..d6f3758ecb 100644 --- a/MdePkg/Library/BaseLib/FilePaths.c +++ b/MdePkg/Library/BaseLib/FilePaths.c @@ -1,7 +1,7 @@ /** @file Defines file-path manipulation functions. - Copyright (c) 2011 - 2016, Intel Corporation. All rights reserved.
+ Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -91,7 +91,7 @@ PathCleanUpDirectories( while ((TempString = StrStr (Path, L"\\.\\")) != NULL) { CopyMem (TempString, TempString + 2, StrSize (TempString + 2)); } - if (StrCmp (Path + StrLen (Path) - 2, L"\\.") == 0) { + if ((StrLen (Path) >= 2) && (StrCmp (Path + StrLen (Path) - 2, L"\\.") == 0)) { Path[StrLen (Path) - 1] = CHAR_NULL; }