The SSID field of a Wi-Fi device path node may not contain a NULL termination.
Additonal handle is added to make sure no cross-boundary memory read/write will occur. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <[email protected]> --- MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c | 9 +++++++-- MdePkg/Library/UefiDevicePathLib/DevicePathToText.c | 11 ++++++++++- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c index 10ba6a4..e0c2dfe 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c @@ -2836,8 +2836,13 @@ DevPathFromTextWiFi ( (UINT16) sizeof (WIFI_DEVICE_PATH) ); - AsciiStr = (CHAR8 *) WiFiDp->SSId; - StrToAscii (SSIdStr, &AsciiStr); + if (NULL != SSIdStr) { + AsciiStr = AllocateZeroPool (StrLen (SSIdStr) + 1); + + UnicodeStrToAsciiStr (SSIdStr, AsciiStr); + CopyMem (WiFiDp->SSId, AsciiStr, sizeof (WiFiDp->SSId)); + FreePool (AsciiStr); + } return (EFI_DEVICE_PATH_PROTOCOL *) WiFiDp; } diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c index 20d8812..abf4dfb 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c @@ -1616,9 +1616,18 @@ DevPathToTextWiFi ( ) { WIFI_DEVICE_PATH *WiFi; + UINT8 SSId[33]; WiFi = DevPath; - UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", WiFi->SSId); + + AsciiStrnCpyS ( + (CHAR8 *)SSId, + sizeof (SSId) / sizeof (SSId[0]), + (CHAR8 *)WiFi->SSId, + sizeof (SSId) / sizeof (SSId[0]) - 1 + ); + + UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", SSId); } /** -- 1.9.5.msysgit.0 _______________________________________________ edk2-devel mailing list [email protected] https://lists.01.org/mailman/listinfo/edk2-devel
