From nobody Thu Dec 26 13:00:47 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1503889793447318.5857327390569; Sun, 27 Aug 2017 20:09:53 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 0277A21E47D64; Sun, 27 Aug 2017 20:07:12 -0700 (PDT) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 6D99B21E47D4C for ; Sun, 27 Aug 2017 20:07:10 -0700 (PDT) Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Aug 2017 20:09:49 -0700 Received: from shwdeopenpsi114.ccr.corp.intel.com ([10.239.157.135]) by fmsmga005.fm.intel.com with ESMTP; 27 Aug 2017 20:09:48 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.41,439,1498546800"; d="scan'208";a="144507003" From: Dandan Bi To: edk2-devel@lists.01.org Date: Mon, 28 Aug 2017 11:09:35 +0800 Message-Id: <1503889775-332544-1-git-send-email-dandan.bi@intel.com> X-Mailer: git-send-email 1.9.5.msysgit.1 Subject: [edk2] [patch] MdeModulePkg/UefiHiiLib: Fix incorrect check for string length X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eric Dong , Liming Gao MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D681 For string opcode,when checking the valid string length, it should exclude the Null-terminated character. And for string in NameValue storage, need to exclude the varname and the need to convert the Config string length to Unicode string length. Cc: Eric Dong Cc: Liming Gao Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dandan Bi --- MdeModulePkg/Library/UefiHiiLib/HiiLib.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/MdeModulePkg/Library/UefiHiiLib/HiiLib.c b/MdeModulePkg/Librar= y/UefiHiiLib/HiiLib.c index cd0cd35..d89e5f3 100644 --- a/MdeModulePkg/Library/UefiHiiLib/HiiLib.c +++ b/MdeModulePkg/Library/UefiHiiLib/HiiLib.c @@ -1605,11 +1605,11 @@ ValidateQuestionFromVfr ( IfrString =3D (EFI_IFR_STRING *) IfrOpHdr; if (IfrString->Question.VarStoreId !=3D VarStoreData.VarStoreId)= { break; } // - // Get Width by OneOf Flags + // Get the Max size of the string. // Width =3D (UINT16) (IfrString->MaxSize * sizeof (UINT16)); if (NameValueType) { QuestionName =3D HiiGetString (HiiHandle, IfrString->Question.= VarStoreInfo.VarName, NULL); ASSERT (QuestionName !=3D NULL); @@ -1619,20 +1619,25 @@ ValidateQuestionFromVfr ( // // This question is not in the current configuration string.= Skip it. // break; } + // + // Skip the VarName. + // + StringPtr +=3D StrLen (QuestionName); =20 // // Skip the "=3D". //=20 StringPtr +=3D 1; =20 // // Check current string length is less than maxsize + // e.g Config String: "0041004200430044", Unicode String: "ABC= D". Unicode String length =3D Config String length / 4. // - if (StrSize (StringPtr) > Width) { + if (StrLen (StringPtr) / 4 > IfrString->MaxSize) { return EFI_INVALID_PARAMETER; } } else { // // Get Offset/Width by Question header and OneOf Flags @@ -1658,11 +1663,11 @@ ValidateQuestionFromVfr ( } =20 // // Check current string length is less than maxsize // - if (StrSize ((CHAR16 *) (VarBuffer + Offset)) > Width) { + if (StrLen ((CHAR16 *) (VarBuffer + Offset)) > IfrString->MaxS= ize) { return EFI_INVALID_PARAMETER; } } break; case EFI_IFR_ONE_OF_OPTION_OP: --=20 1.9.5.msysgit.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel