Good discovery. Reviewed-by: Feng Tian <[email protected]>
-----Original Message----- From: Wu, Hao A Sent: Friday, August 28, 2015 1:16 PM To: [email protected]; Tian, Feng; Gao, Liming Cc: Wu, Hao A Subject: RE: [edk2] [PATCH v3 2/2] MdePkg UefiDevicePathLib: Fix possible memory read/write cross boundary I've discovered that: AsciiStrnCpyS ( (CHAR8 *)SSId, sizeof (SSId) / sizeof (SSId[0]), (CHAR8 *)WiFi->SSId, sizeof (SSId) / sizeof (SSId[0]) - 1 ); in DevicePathToText.c will cause a 1-byte memory read cross boundary in function AsciiStrnLenS(), when WiFi->SSId do not contain a NULL terminator. Therefore, I replace the above code as below: SSId[32] = '\0'; CopyMem (SSId, WiFi->SSId, 32); Best Regards, Hao Wu > -----Original Message----- > From: edk2-devel [mailto:[email protected]] On Behalf Of > Hao Wu > Sent: Friday, August 28, 2015 11:49 AM > To: [email protected]; Tian, Feng; Gao, Liming > Cc: Wu, Hao A > Subject: [edk2] [PATCH v3 2/2] MdePkg UefiDevicePathLib: Fix possible > memory read/write cross boundary > > The SSID field of a Wi-Fi device path node may not contain a NULL > termination. > > Additonal handle is added to make sure no cross-boundary memory > read/write will occur. > > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Hao Wu <[email protected]> > --- > MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c | 15 > ++++++++++++--- > MdePkg/Library/UefiDevicePathLib/DevicePathToText.c | 11 ++++++++++- > 2 files changed, 22 insertions(+), 4 deletions(-) > > diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c > b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c > index 10ba6a4..abb2642 100644 > --- a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c > +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c > @@ -2826,7 +2826,8 @@ DevPathFromTextWiFi ( > ) > { > CHAR16 *SSIdStr; > - CHAR8 *AsciiStr; > + CHAR8 AsciiStr[33]; > + UINTN DataLen; > WIFI_DEVICE_PATH *WiFiDp; > > SSIdStr = GetNextParamStr (&TextDeviceNode); @@ -2836,8 +2837,16 @@ > DevPathFromTextWiFi ( > (UINT16) sizeof (WIFI_DEVICE_PATH) > ); > > - AsciiStr = (CHAR8 *) WiFiDp->SSId; > - StrToAscii (SSIdStr, &AsciiStr); > + if (NULL != SSIdStr) { > + DataLen = StrLen (SSIdStr); > + if (StrLen (SSIdStr) > 32) { > + SSIdStr[32] = L'\0'; > + DataLen = 32; > + } > + > + UnicodeStrToAsciiStr (SSIdStr, AsciiStr); > + CopyMem (WiFiDp->SSId, AsciiStr, DataLen); } > > return (EFI_DEVICE_PATH_PROTOCOL *) WiFiDp; } diff --git > a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c > b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c > index 20d8812..abf4dfb 100644 > --- a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c > +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c > @@ -1616,9 +1616,18 @@ DevPathToTextWiFi ( > ) > { > WIFI_DEVICE_PATH *WiFi; > + UINT8 SSId[33]; > > WiFi = DevPath; > - UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", WiFi->SSId); > + > + AsciiStrnCpyS ( > + (CHAR8 *)SSId, > + sizeof (SSId) / sizeof (SSId[0]), > + (CHAR8 *)WiFi->SSId, > + sizeof (SSId) / sizeof (SSId[0]) - 1 > + ); > + > + UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", SSId); > } > > /** > -- > 1.9.5.msysgit.0 > > _______________________________________________ > edk2-devel mailing list > [email protected] > https://lists.01.org/mailman/listinfo/edk2-devel _______________________________________________ edk2-devel mailing list [email protected] https://lists.01.org/mailman/listinfo/edk2-devel
