1. Patchew
  2. EDK2
  3. [edk2] [PATCH v2 0/2] Fix error in PrintLib
  4. View patch

[edk2] [PATCH v2 1/2] MdePkg/BasePrintLib: Fix error in Precision position calculation

Jian J Wang posted 2 patches 6 years, 12 months ago
[edk2] [PATCH v2 1/2] MdePkg/BasePrintLib: Fix error in Precision position calculation
Posted by Jian J Wang 6 years, 12 months ago 
> v2:
>    a. Correct incorrect description in commit log
>    b. Fix another similar issue in the same function

Due to a potential hole in the stop condition of loop, the two continuous
access to ArgumentString (index, index+1) inside the loop might cause the
string ending character ('\0') and the byte after it to be read.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
---
 MdePkg/Library/BasePrintLib/PrintLibInternal.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
index 28d946472f..fc57255068 100644
--- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
+++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
@@ -1107,7 +1107,10 @@ BasePrintLibSPrintMarker (
       // Compute the number of characters in ArgumentString and store it in Count
       // ArgumentString is either null-terminated, or it contains Precision characters
       //
-      for (Count = 0; Count < Precision || ((Flags & PRECISION) == 0); Count++) {
+      for (Count = 0;
+            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
+            (Count < Precision || ((Flags & PRECISION) == 0));
+              Count++) {
         ArgumentCharacter = ((ArgumentString[Count * BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count * BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
         if (ArgumentCharacter == 0) {
           break;
@@ -1164,7 +1167,7 @@ BasePrintLibSPrintMarker (
     //
     // Copy the string into the output buffer performing the required type conversions
     //
-    while (Index < Count) {
+    while (Index < Count && (*ArgumentString) != '\0') {
       ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
 
       LengthToReturn += (1 * BytesPerOutputCharacter);
-- 
2.15.1.windows.2

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH v2 1/2] MdePkg/BasePrintLib: Fix error in Precision position calculation
Posted by Ard Biesheuvel 6 years, 11 months ago 
On 28 December 2017 at 02:38, Jian J Wang <jian.j.wang@intel.com> wrote:
>> v2:
>>    a. Correct incorrect description in commit log
>>    b. Fix another similar issue in the same function
>
> Due to a potential hole in the stop condition of loop, the two continuous
> access to ArgumentString (index, index+1) inside the loop might cause the
> string ending character ('\0') and the byte after it to be read.
>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> ---
>  MdePkg/Library/BasePrintLib/PrintLibInternal.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> index 28d946472f..fc57255068 100644
> --- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> +++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> @@ -1107,7 +1107,10 @@ BasePrintLibSPrintMarker (
>        // Compute the number of characters in ArgumentString and store it in Count
>        // ArgumentString is either null-terminated, or it contains Precision characters
>        //
> -      for (Count = 0; Count < Precision || ((Flags & PRECISION) == 0); Count++) {
> +      for (Count = 0;
> +            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
> +            (Count < Precision || ((Flags & PRECISION) == 0));
> +              Count++) {
>          ArgumentCharacter = ((ArgumentString[Count * BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count * BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
>          if (ArgumentCharacter == 0) {
>            break;
> @@ -1164,7 +1167,7 @@ BasePrintLibSPrintMarker (
>      //
>      // Copy the string into the output buffer performing the required type conversions
>      //
> -    while (Index < Count) {
> +    while (Index < Count && (*ArgumentString) != '\0') {
>        ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
>
>        LengthToReturn += (1 * BytesPerOutputCharacter);

This patch breaks UEFI menu rendering: the following

/------------------------------------------------------------------------------\
|                               Device Manager                                 |
\------------------------------------------------------------------------------/


is rendered as

/\
|                               Device Manager                                 |
\/.0                                                 2.00 GHz

(the spurious digits are SMBIOS data from the home screen)

The problem appears to be that the CHAR16 value of BOXDRAW_HORIZONTAL
equals 0x2500, which means that testing ArgumentString[] != '\0'
(which tests the low byte only) will yield FALSE and terminate the
loop prematurely.

The following patch fixes things for me.

diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
index fc5725506848..3f4be932f369 100644
--- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
+++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
@@ -1108,7 +1108,9 @@ BasePrintLibSPrintMarker (
       // ArgumentString is either null-terminated, or it contains
Precision characters
       //
       for (Count = 0;
-            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
+            (ArgumentString[Count * BytesPerArgumentCharacter] != '\0' ||
+             (BytesPerArgumentCharacter > 1 &&
+              ArgumentString[Count * BytesPerArgumentCharacter + 1]
!= '\0')) &&
             (Count < Precision || ((Flags & PRECISION) == 0));
               Count++) {
         ArgumentCharacter = ((ArgumentString[Count *
BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count *
BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
@@ -1167,7 +1169,9 @@ BasePrintLibSPrintMarker (
     //
     // Copy the string into the output buffer performing the required
type conversions
     //
-    while (Index < Count && (*ArgumentString) != '\0') {
+    while (Index < Count &&
+           (ArgumentString[0] != '\0' ||
+            (BytesPerArgumentCharacter > 1 && ArgumentString[1] != '\0'))) {
       ArgumentCharacter = ((*ArgumentString & 0xff) |
(((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;

       LengthToReturn += (1 * BytesPerOutputCharacter);
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH v2 1/2] MdePkg/BasePrintLib: Fix error in Precision position calculation
Posted by Wang, Jian J 6 years, 11 months ago 
Ard,

Thanks for the fix.

Regards,
Jian

> -----Original Message-----
> From: Ard Biesheuvel [mailto:ard.biesheuvel@linaro.org]
> Sent: Sunday, December 31, 2017 11:57 PM
> To: Wang, Jian J <jian.j.wang@intel.com>
> Cc: edk2-devel@lists.01.org; Kinney, Michael D <michael.d.kinney@intel.com>;
> Yao, Jiewen <jiewen.yao@intel.com>; Zeng, Star <star.zeng@intel.com>; Gao,
> Liming <liming.gao@intel.com>
> Subject: Re: [edk2] [PATCH v2 1/2] MdePkg/BasePrintLib: Fix error in Precision
> position calculation
> 
> On 28 December 2017 at 02:38, Jian J Wang <jian.j.wang@intel.com> wrote:
> >> v2:
> >>    a. Correct incorrect description in commit log
> >>    b. Fix another similar issue in the same function
> >
> > Due to a potential hole in the stop condition of loop, the two continuous
> > access to ArgumentString (index, index+1) inside the loop might cause the
> > string ending character ('\0') and the byte after it to be read.
> >
> > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > Cc: Liming Gao <liming.gao@intel.com>
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > Cc: Star Zeng <star.zeng@intel.com>
> > Contributed-under: TianoCore Contribution Agreement 1.1
> > Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> > ---
> >  MdePkg/Library/BasePrintLib/PrintLibInternal.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> > index 28d946472f..fc57255068 100644
> > --- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> > +++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> > @@ -1107,7 +1107,10 @@ BasePrintLibSPrintMarker (
> >        // Compute the number of characters in ArgumentString and store it in
> Count
> >        // ArgumentString is either null-terminated, or it contains Precision
> characters
> >        //
> > -      for (Count = 0; Count < Precision || ((Flags & PRECISION) == 0); Count++) {
> > +      for (Count = 0;
> > +            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
> > +            (Count < Precision || ((Flags & PRECISION) == 0));
> > +              Count++) {
> >          ArgumentCharacter = ((ArgumentString[Count *
> BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count *
> BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
> >          if (ArgumentCharacter == 0) {
> >            break;
> > @@ -1164,7 +1167,7 @@ BasePrintLibSPrintMarker (
> >      //
> >      // Copy the string into the output buffer performing the required type
> conversions
> >      //
> > -    while (Index < Count) {
> > +    while (Index < Count && (*ArgumentString) != '\0') {
> >        ArgumentCharacter = ((*ArgumentString & 0xff) |
> (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
> >
> >        LengthToReturn += (1 * BytesPerOutputCharacter);
> 
> This patch breaks UEFI menu rendering: the following
> 
> /------------------------------------------------------------------------------\
> |                               Device Manager                                 |
> \------------------------------------------------------------------------------/
> 
> 
> is rendered as
> 
> /\
> |                               Device Manager                                 |
> \/.0                                                 2.00 GHz
> 
> (the spurious digits are SMBIOS data from the home screen)
> 
> The problem appears to be that the CHAR16 value of BOXDRAW_HORIZONTAL
> equals 0x2500, which means that testing ArgumentString[] != '\0'
> (which tests the low byte only) will yield FALSE and terminate the
> loop prematurely.
> 
> The following patch fixes things for me.
> 
> diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> index fc5725506848..3f4be932f369 100644
> --- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> +++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c
> @@ -1108,7 +1108,9 @@ BasePrintLibSPrintMarker (
>        // ArgumentString is either null-terminated, or it contains
> Precision characters
>        //
>        for (Count = 0;
> -            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
> +            (ArgumentString[Count * BytesPerArgumentCharacter] != '\0' ||
> +             (BytesPerArgumentCharacter > 1 &&
> +              ArgumentString[Count * BytesPerArgumentCharacter + 1]
> != '\0')) &&
>              (Count < Precision || ((Flags & PRECISION) == 0));
>                Count++) {
>          ArgumentCharacter = ((ArgumentString[Count *
> BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count *
> BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
> @@ -1167,7 +1169,9 @@ BasePrintLibSPrintMarker (
>      //
>      // Copy the string into the output buffer performing the required
> type conversions
>      //
> -    while (Index < Count && (*ArgumentString) != '\0') {
> +    while (Index < Count &&
> +           (ArgumentString[0] != '\0' ||
> +            (BytesPerArgumentCharacter > 1 && ArgumentString[1] != '\0'))) {
>        ArgumentCharacter = ((*ArgumentString & 0xff) |
> (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
> 
>        LengthToReturn += (1 * BytesPerOutputCharacter);
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Patchew 2.1-devel-8c64711

© 2016 - 2024 Red Hat, Inc.