Reviewed-by: Eric Dong <[email protected]> -----Original Message----- From: Bi, Dandan Sent: Tuesday, August 29, 2017 2:45 PM To: [email protected] Cc: Dong, Eric <[email protected]>; Gao, Liming <[email protected]> Subject: [PATCH v2] MdeModulePkg/UefiHiiLib: Fix incorrect check for string length
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=681 For string opcode,when checking the valid string length, it should exclude the Null-terminated character. And for string in NameValue storage, need to exclude the varname and also need to convert the Config string length to Unicode string length. Cc: Eric Dong <[email protected]> Cc: Liming Gao <[email protected]> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Dandan Bi <[email protected]> --- MdeModulePkg/Library/UefiHiiLib/HiiLib.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/MdeModulePkg/Library/UefiHiiLib/HiiLib.c b/MdeModulePkg/Library/UefiHiiLib/HiiLib.c index cd0cd35..5249392 100644 --- a/MdeModulePkg/Library/UefiHiiLib/HiiLib.c +++ b/MdeModulePkg/Library/UefiHiiLib/HiiLib.c @@ -1605,11 +1605,11 @@ ValidateQuestionFromVfr ( IfrString = (EFI_IFR_STRING *) IfrOpHdr; if (IfrString->Question.VarStoreId != VarStoreData.VarStoreId) { break; } // - // Get Width by OneOf Flags + // Get the Max size of the string. // Width = (UINT16) (IfrString->MaxSize * sizeof (UINT16)); if (NameValueType) { QuestionName = HiiGetString (HiiHandle, IfrString->Question.VarStoreInfo.VarName, NULL); ASSERT (QuestionName != NULL); @@ -1619,20 +1619,29 @@ ValidateQuestionFromVfr ( // // This question is not in the current configuration string. Skip it. // break; } + // + // Skip the VarName. + // + StringPtr += StrLen (QuestionName); // // Skip the "=". // StringPtr += 1; // // Check current string length is less than maxsize + // e.g Config String: "0041004200430044", Unicode String: "ABCD". Unicode String length = Config String length / 4. + // Config string format in UEFI spec. + // <NvConfig> ::= <Label>'='<String> + // <String> ::= [<Char>]+ + // <Char> ::= <HexCh>4 // - if (StrSize (StringPtr) > Width) { + if (StrLen (StringPtr) / 4 > IfrString->MaxSize) { return EFI_INVALID_PARAMETER; } } else { // // Get Offset/Width by Question header and OneOf Flags @@ -1658,11 +1667,11 @@ ValidateQuestionFromVfr ( } // // Check current string length is less than maxsize // - if (StrSize ((CHAR16 *) (VarBuffer + Offset)) > Width) { + if (StrLen ((CHAR16 *) (VarBuffer + Offset)) > + IfrString->MaxSize) { return EFI_INVALID_PARAMETER; } } break; case EFI_IFR_ONE_OF_OPTION_OP: -- 1.9.5.msysgit.1 _______________________________________________ edk2-devel mailing list [email protected] https://lists.01.org/mailman/listinfo/edk2-devel
