From 889f1f4cffe3889074d26bc53e2484784c760844 Mon Sep 17 00:00:00 2001 From: Hao Wu Date: Fri, 28 Aug 2015 07:51:45 +0000 Subject: MdePkg UefiDevicePathLib: Fix possible memory read/write cross boundary The SSID field of a Wi-Fi device path node may not contain a NULL termination. Additonal handle is added to make sure no cross-boundary memory read/write will occur. (Sync patch r18355 from main trunk.) Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu Reviewed-by: Feng Tian git-svn-id: https://svn.code.sf.net/p/edk2/code/branches/UDK2015@18358 6f19259b-4bc3-4df7-8a09-765794883524 --- MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c | 15 ++++++++++++--- MdePkg/Library/UefiDevicePathLib/DevicePathToText.c | 7 ++++++- 2 files changed, 18 insertions(+), 4 deletions(-) (limited to 'MdePkg') diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c index 9c5436d337..6a9b389ca5 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c @@ -2827,7 +2827,8 @@ DevPathFromTextWiFi ( ) { CHAR16 *SSIdStr; - CHAR8 *AsciiStr; + CHAR8 AsciiStr[33]; + UINTN DataLen; WIFI_DEVICE_PATH *WiFiDp; SSIdStr = GetNextParamStr (&TextDeviceNode); @@ -2837,8 +2838,16 @@ DevPathFromTextWiFi ( (UINT16) sizeof (WIFI_DEVICE_PATH) ); - AsciiStr = (CHAR8 *) WiFiDp->SSId; - StrToAscii (SSIdStr, &AsciiStr); + if (NULL != SSIdStr) { + DataLen = StrLen (SSIdStr); + if (StrLen (SSIdStr) > 32) { + SSIdStr[32] = L'\0'; + DataLen = 32; + } + + UnicodeStrToAsciiStr (SSIdStr, AsciiStr); + CopyMem (WiFiDp->SSId, AsciiStr, DataLen); + } return (EFI_DEVICE_PATH_PROTOCOL *) WiFiDp; } diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c index 0774fd8c17..363830bd32 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c @@ -1616,9 +1616,14 @@ DevPathToTextWiFi ( ) { WIFI_DEVICE_PATH *WiFi; + UINT8 SSId[33]; WiFi = DevPath; - UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", WiFi->SSId); + + SSId[32] = '\0'; + CopyMem (SSId, WiFi->SSId, 32); + + UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", SSId); } /** -- cgit v1.2.3