+ CopyMem (WiFiDp->SSId, AsciiStr, sizeof (WiFiDp->SSId)); This would bring issue if the AsciiStr is less than 32 characters as you will copy some rubbish value to SSId.
And what if the passing string of SSID is invalid, for example, the length is larger than 32? Shall we return NULL or the first 32bytes? Thanks Feng -----Original Message----- From: Wu, Hao A Sent: Thursday, August 27, 2015 8:23 PM To: [email protected]; Tian, Feng; Gao, Liming Cc: Wu, Hao A Subject: [PATCH v2 2/2] MdePkg UefiDevicePathLib: Fix possible memory read/write cross boundary The SSID field of a Wi-Fi device path node may not contain a NULL termination. Additonal handle is added to make sure no cross-boundary memory read/write will occur. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <[email protected]> --- MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c | 9 +++++++-- MdePkg/Library/UefiDevicePathLib/DevicePathToText.c | 11 ++++++++++- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c index 10ba6a4..e0c2dfe 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c @@ -2836,8 +2836,13 @@ DevPathFromTextWiFi ( (UINT16) sizeof (WIFI_DEVICE_PATH) ); - AsciiStr = (CHAR8 *) WiFiDp->SSId; - StrToAscii (SSIdStr, &AsciiStr); + if (NULL != SSIdStr) { + AsciiStr = AllocateZeroPool (StrLen (SSIdStr) + 1); + + UnicodeStrToAsciiStr (SSIdStr, AsciiStr); + CopyMem (WiFiDp->SSId, AsciiStr, sizeof (WiFiDp->SSId)); + FreePool (AsciiStr); + } return (EFI_DEVICE_PATH_PROTOCOL *) WiFiDp; } diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c index 20d8812..abf4dfb 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c @@ -1616,9 +1616,18 @@ DevPathToTextWiFi ( ) { WIFI_DEVICE_PATH *WiFi; + UINT8 SSId[33]; WiFi = DevPath; - UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", WiFi->SSId); + + AsciiStrnCpyS ( + (CHAR8 *)SSId, + sizeof (SSId) / sizeof (SSId[0]), + (CHAR8 *)WiFi->SSId, + sizeof (SSId) / sizeof (SSId[0]) - 1 + ); + + UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", SSId); } /** -- 1.9.5.msysgit.0 _______________________________________________ edk2-devel mailing list [email protected] https://lists.01.org/mailman/listinfo/edk2-devel
