Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
 BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp b/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
index 0fe14b0d29..4866639aab 100644
--- a/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
+++ b/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
@@ -15,6 +15,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 
 #include "stdio.h"
 #include "stdlib.h"
+#include "assert.h"
 #include "CommonLib.h"
 #include "VfrUtilityLib.h"
 #include "VfrFormPkg.h"
@@ -842,7 +843,9 @@ CVfrVarDataTypeDB::InternalTypesListInit (
   for (Index = 0; gInternalTypesTable[Index].mTypeName != NULL; Index++) {
     New                 = new SVfrDataType;
     if (New != NULL) {
-      strcpy (New->mTypeName, gInternalTypesTable[Index].mTypeName);
+      assert (strlen (gInternalTypesTable[Index].mTypeName) < MAX_NAME_LEN);
+      strncpy (New->mTypeName, gInternalTypesTable[Index].mTypeName, MAX_NAME_LEN - 1);
+      New->mTypeName[MAX_NAME_LEN - 1] = 0;
       New->mType        = gInternalTypesTable[Index].mType;
       New->mAlign       = gInternalTypesTable[Index].mAlign;
       New->mTotalSize   = gInternalTypesTable[Index].mSize;
@@ -1084,7 +1087,8 @@ CVfrVarDataTypeDB::SetNewTypeName (
     }
   }
 
-  strcpy(mNewDataType->mTypeName, TypeName);
+  strncpy(mNewDataType->mTypeName, TypeName, MAX_NAME_LEN - 1);
+  mNewDataType->mTypeName[MAX_NAME_LEN - 1] = 0;
   return VFR_RETURN_SUCCESS;
 }
 
@@ -1145,7 +1149,8 @@ CVfrVarDataTypeDB::DataTypeAddBitField (
 
   MaxDataTypeSize = mNewDataType->mTotalSize;
   if (FieldName != NULL) {
-    strcpy (pNewField->mFieldName, FieldName);
+    strncpy (pNewField->mFieldName, FieldName, MAX_NAME_LEN - 1);
+    pNewField->mFieldName[MAX_NAME_LEN - 1] = 0;
   }
   pNewField->mFieldType    = pFieldType;
   pNewField->mIsBitField   = TRUE;
@@ -1239,7 +1244,8 @@ CVfrVarDataTypeDB::DataTypeAddField (
   if ((pNewField = new SVfrDataField) == NULL) {
     return VFR_RETURN_OUT_FOR_RESOURCES;
   }
-  strcpy (pNewField->mFieldName, FieldName);
+  strncpy (pNewField->mFieldName, FieldName, MAX_NAME_LEN - 1);
+  pNewField->mFieldName[MAX_NAME_LEN - 1] = 0;
   pNewField->mFieldType    = pFieldType;
   pNewField->mArrayNum     = ArrayNum;
   pNewField->mIsBitField   = FALSE;
-- 
2.12.0.windows.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel