This is caused by a previous patch which tried to fix string over-read.
It's found that that patch for PrintLib in MdePkg will cause premature
terminating of loop used to traversing format string and cause incomplete
string output. Because this library uses similar code to do the same
job, it has the same issue too. So the fix is also the same.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
---
 MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
index 0e6178fc9c..e09520c81b 100644
--- a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
+++ b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
@@ -2051,7 +2051,9 @@ InternalPrintLibSPrintMarker (
       // ArgumentString is either null-terminated, or it contains Precision characters
       //
       for (Count = 0;
-            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
+            (ArgumentString[Count * BytesPerArgumentCharacter] != '\0' ||
+             (BytesPerArgumentCharacter > 1 &&
+              ArgumentString[Count * BytesPerArgumentCharacter + 1]!= '\0')) &&
             (Count < Precision || ((Flags & PRECISION) == 0));
             Count++) {
         ArgumentCharacter = ((ArgumentString[Count * BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count * BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
@@ -2110,7 +2112,9 @@ InternalPrintLibSPrintMarker (
     //
     // Copy the string into the output buffer performing the required type conversions
     //
-    while (Index < Count && (*ArgumentString) != '\0') {
+    while (Index < Count &&
+           (ArgumentString[0] != '\0' ||
+            (BytesPerArgumentCharacter > 1 && ArgumentString[1] != '\0'))) {
       ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
 
       LengthToReturn += (1 * BytesPerOutputCharacter);
-- 
2.15.1.windows.2

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Reviewed-by: Star Zeng <star.zeng@intel.com>

Thanks,
Star
-----Original Message-----
From: Wang, Jian J 
Sent: Tuesday, January 2, 2018 4:20 PM
To: edk2-devel@lists.01.org
Cc: Gao, Liming <liming.gao@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Zeng, Star <star.zeng@intel.com>
Subject: [PATCH 2/2] MdeModulePkg/DxePrintLibPrint2Protocol: Fix incomplete print output

This is caused by a previous patch which tried to fix string over-read.
It's found that that patch for PrintLib in MdePkg will cause premature terminating of loop used to traversing format string and cause incomplete string output. Because this library uses similar code to do the same job, it has the same issue too. So the fix is also the same.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
---
 MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
index 0e6178fc9c..e09520c81b 100644
--- a/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
+++ b/MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
@@ -2051,7 +2051,9 @@ InternalPrintLibSPrintMarker (
       // ArgumentString is either null-terminated, or it contains Precision characters
       //
       for (Count = 0;
-            ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
+            (ArgumentString[Count * BytesPerArgumentCharacter] != '\0' ||
+             (BytesPerArgumentCharacter > 1 &&
+              ArgumentString[Count * BytesPerArgumentCharacter + 1]!= 
+ '\0')) &&
             (Count < Precision || ((Flags & PRECISION) == 0));
             Count++) {
         ArgumentCharacter = ((ArgumentString[Count * BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count * BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask; @@ -2110,7 +2112,9 @@ InternalPrintLibSPrintMarker (
     //
     // Copy the string into the output buffer performing the required type conversions
     //
-    while (Index < Count && (*ArgumentString) != '\0') {
+    while (Index < Count &&
+           (ArgumentString[0] != '\0' ||
+            (BytesPerArgumentCharacter > 1 && ArgumentString[1] != 
+ '\0'))) {
       ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
 
       LengthToReturn += (1 * BytesPerOutputCharacter);
--
2.15.1.windows.2

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel