diff options
| author | Hao Wu <hao.a.wu@intel.com> | 2015-08-28 07:51:45 +0000 |
|---|---|---|
| committer | hwu1225 <hwu1225@Edk2> | 2015-08-28 07:51:45 +0000 |
| commit | 889f1f4cffe3889074d26bc53e2484784c760844 (patch) | |
| tree | 44369bb33f6bbc017c3c85106cc0484e36ce5869 | |
| parent | 6896bb7f4e9c2d81c5121ff94e7b931d5764249e (diff) | |
| download | edk2-platforms-889f1f4cffe3889074d26bc53e2484784c760844.tar.xz | |
MdePkg UefiDevicePathLib: Fix possible memory read/write cross boundary
The SSID field of a Wi-Fi device path node may not contain a NULL
termination.
Additonal handle is added to make sure no cross-boundary memory read/write
will occur.
(Sync patch r18355 from main trunk.)
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18358 6f19259b-4bc3-4df7-8a09-765794883524
| -rw-r--r-- | MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c | 15 | ||||
| -rw-r--r-- | MdePkg/Library/UefiDevicePathLib/DevicePathToText.c | 7 |
2 files changed, 18 insertions, 4 deletions
diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c index 9c5436d337..6a9b389ca5 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c @@ -2827,7 +2827,8 @@ DevPathFromTextWiFi ( )
{
CHAR16 *SSIdStr;
- CHAR8 *AsciiStr;
+ CHAR8 AsciiStr[33];
+ UINTN DataLen;
WIFI_DEVICE_PATH *WiFiDp;
SSIdStr = GetNextParamStr (&TextDeviceNode);
@@ -2837,8 +2838,16 @@ DevPathFromTextWiFi ( (UINT16) sizeof (WIFI_DEVICE_PATH)
);
- AsciiStr = (CHAR8 *) WiFiDp->SSId;
- StrToAscii (SSIdStr, &AsciiStr);
+ if (NULL != SSIdStr) {
+ DataLen = StrLen (SSIdStr);
+ if (StrLen (SSIdStr) > 32) {
+ SSIdStr[32] = L'\0';
+ DataLen = 32;
+ }
+
+ UnicodeStrToAsciiStr (SSIdStr, AsciiStr);
+ CopyMem (WiFiDp->SSId, AsciiStr, DataLen);
+ }
return (EFI_DEVICE_PATH_PROTOCOL *) WiFiDp;
}
diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c index 0774fd8c17..363830bd32 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c @@ -1616,9 +1616,14 @@ DevPathToTextWiFi ( )
{
WIFI_DEVICE_PATH *WiFi;
+ UINT8 SSId[33];
WiFi = DevPath;
- UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", WiFi->SSId);
+
+ SSId[32] = '\0';
+ CopyMem (SSId, WiFi->SSId, 32);
+
+ UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", SSId);
}
/**
|