Revision: 17931
http://sourceforge.net/p/edk2/code/17931
Author: hwu1225
Date: 2015-07-13 01:23:14 +0000 (Mon, 13 Jul 2015)
Log Message:
-----------
IntelFrameworkModulePkg BootMaint: Fix potential read over memory boundary
This commit will resolve the issue brought by r17736.
Str = AllocateCopyPool (MaxLen * sizeof (CHAR16), Str1);
The above using of AllocateCopyPool() will read contents out of the scope
of Str1. Potential risk for Str1 allocated at the boundary of memory
region.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <[email protected]>
Reviewed-by: Qiu Shumin <[email protected]>
Reviewed-by: Jeff Fan <[email protected]>
Revision Links:
--------------
http://sourceforge.net/p/edk2/code/17736
Modified Paths:
--------------
trunk/edk2/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/BootOption.c
Modified:
trunk/edk2/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/BootOption.c
===================================================================
--- trunk/edk2/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/BootOption.c
2015-07-13 01:22:44 UTC (rev 17930)
+++ trunk/edk2/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/BootOption.c
2015-07-13 01:23:14 UTC (rev 17931)
@@ -1096,12 +1096,13 @@
Size1 = StrSize (Str1);
Size2 = StrSize (Str2);
MaxLen = (Size1 + Size2 + sizeof (CHAR16)) / sizeof (CHAR16);
- Str = AllocateCopyPool (MaxLen * sizeof (CHAR16), Str1);
+ Str = AllocateZeroPool (MaxLen * sizeof (CHAR16));
ASSERT (Str != NULL);
TmpStr = AllocateZeroPool (MaxLen * sizeof (CHAR16));
ASSERT (TmpStr != NULL);
+ StrCatS (Str, MaxLen, Str1);
if (!((*Str == '\\') && (*(Str + 1) == 0))) {
StrCatS (Str, MaxLen, L"\\");
}
------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
