ShellPkg: Avoid buffer out-of-bound access

[edk2] [PATCH] ShellPkg: Avoid buffer out-of-bound access

Posted by Ruiyu Ni 7 years, 5 months ago

PathSize is the number of bytes in PathForReturn buffer so
PathForReturn[PathSize - 1] incorrectly accesses the last
character in the buffer,
PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Steven Shi <steven.shi@intel.com>
---
 ShellPkg/Application/Shell/ShellProtocol.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c
index b3b8acc0d0..991fb58ca7 100644
--- a/ShellPkg/Application/Shell/ShellProtocol.c
+++ b/ShellPkg/Application/Shell/ShellProtocol.c
@@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath(
         //  UEFI Shell spec section 3.7)
         if ((PathSize != 0)                        &&
             (PathForReturn != NULL)                &&
-            (PathForReturn[PathSize - 1] != L'\\') &&
+            (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') &&
             (AlignedNode->PathName[0]    != L'\\')) {
           PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1);
         }
-- 
2.12.2.windows.2

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [edk2] [PATCH] ShellPkg: Avoid buffer out-of-bound access

Posted by Shi, Steven 7 years, 5 months ago

Reviewed-by: Steven Shi <steven.shi@intel.com>

Thanks
Steven Shi


> -----Original Message-----
> From: Ni, Ruiyu
> Sent: Wednesday, July 26, 2017 4:22 PM
> To: edk2-devel@lists.01.org
> Cc: Shi, Steven <steven.shi@intel.com>
> Subject: [PATCH] ShellPkg: Avoid buffer out-of-bound access
> 
> PathSize is the number of bytes in PathForReturn buffer so
> PathForReturn[PathSize - 1] incorrectly accesses the last
> character in the buffer,
> PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used.
> 
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
> Cc: Steven Shi <steven.shi@intel.com>
> ---
>  ShellPkg/Application/Shell/ShellProtocol.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/ShellPkg/Application/Shell/ShellProtocol.c
> b/ShellPkg/Application/Shell/ShellProtocol.c
> index b3b8acc0d0..991fb58ca7 100644
> --- a/ShellPkg/Application/Shell/ShellProtocol.c
> +++ b/ShellPkg/Application/Shell/ShellProtocol.c
> @@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath(
>          //  UEFI Shell spec section 3.7)
>          if ((PathSize != 0)                        &&
>              (PathForReturn != NULL)                &&
> -            (PathForReturn[PathSize - 1] != L'\\') &&
> +            (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') &&
>              (AlignedNode->PathName[0]    != L'\\')) {
>            PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1);
>          }
> --
> 2.12.2.windows.2

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel