Re: [edk2] [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string boundary

[Ni, Ruiyu]

Reviewed-by: Ruiyu Ni <ruiyu...@intel.com>

-Original Message-
From: edk2-devel [mailto:edk2-devel-boun...@lists.01.org] On Behalf Of Hao Wu
Sent: Tuesday, September 19, 2017 7:39 PM
To: edk2-devel@lists.01.org
Cc: Wu, Hao A <hao.a...@intel.com>; Ni, Ruiyu <ruiyu...@intel.com>; Carsey, 
Jaben <jaben.car...@intel.com>
Subject: [edk2] [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string 
boundary

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=690

Within function EfiShellGetDevicePathFromFilePath(), when the input parameter 
'Path' string is like:
"FS0:"

It is possible for the below statement:
"if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {"

to read the content 1 byte beyond the string boundary (both 'Path' and 
'MapName' will be FS0: in this case).

This commit adds additional checks to avoid this.

Cc: Ruiyu Ni <ruiyu...@intel.com>
Cc: Jaben Carsey <jaben.car...@intel.com>
Cc: Steven Shi <steven@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a...@intel.com>
---
 ShellPkg/Application/Shell/ShellProtocol.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ShellPkg/Application/Shell/ShellProtocol.c 
b/ShellPkg/Application/Shell/ShellProtocol.c
index 40e5e653ae..5e34b8dad1 100644
--- a/ShellPkg/Application/Shell/ShellProtocol.c
+++ b/ShellPkg/Application/Shell/ShellProtocol.c
@@ -598,7 +598,8 @@ EfiShellGetDevicePathFromFilePath(
   //
   // build the full device path
   //
-  if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {
+  if ((*(Path+StrLen(MapName)) != CHAR_NULL) &&
+  (*(Path+StrLen(MapName)+1) == CHAR_NULL)) {
 DevicePathForReturn = FileDevicePath(Handle, L"\\");
   } else {
 DevicePathForReturn = FileDevicePath(Handle, Path+StrLen(MapName));
--
2.12.0.windows.1

___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: [edk2] [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string boundary

[Carsey, Jaben]

Reviewed-by: Jaben Carsey 

> -Original Message-
> From: Wu, Hao A
> Sent: Tuesday, September 19, 2017 4:39 AM
> To: edk2-devel@lists.01.org
> Cc: Wu, Hao A ; Ni, Ruiyu ;
> Carsey, Jaben ; Shi, Steven
> 
> Subject: [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string
> boundary
> Importance: High
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=690
> 
> Within function EfiShellGetDevicePathFromFilePath(), when the input
> parameter 'Path' string is like:
> "FS0:"
> 
> It is possible for the below statement:
> "if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {"
> 
> to read the content 1 byte beyond the string boundary (both 'Path' and
> 'MapName' will be FS0: in this case).
> 
> This commit adds additional checks to avoid this.
> 
> Cc: Ruiyu Ni 
> Cc: Jaben Carsey 
> Cc: Steven Shi 
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Hao Wu 
> ---
>  ShellPkg/Application/Shell/ShellProtocol.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/ShellPkg/Application/Shell/ShellProtocol.c
> b/ShellPkg/Application/Shell/ShellProtocol.c
> index 40e5e653ae..5e34b8dad1 100644
> --- a/ShellPkg/Application/Shell/ShellProtocol.c
> +++ b/ShellPkg/Application/Shell/ShellProtocol.c
> @@ -598,7 +598,8 @@ EfiShellGetDevicePathFromFilePath(
>//
>// build the full device path
>//
> -  if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {
> +  if ((*(Path+StrLen(MapName)) != CHAR_NULL) &&
> +  (*(Path+StrLen(MapName)+1) == CHAR_NULL)) {
>  DevicePathForReturn = FileDevicePath(Handle, L"\\");
>} else {
>  DevicePathForReturn = FileDevicePath(Handle, Path+StrLen(MapName));
> --
> 2.12.0.windows.1

___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

[edk2] [PATCH 1/2] ShellPkg/Shell: Avoid reading content beyond string boundary

[Hao Wu]

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=690

Within function EfiShellGetDevicePathFromFilePath(), when the input
parameter 'Path' string is like:
"FS0:"

It is possible for the below statement:
"if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {"

to read the content 1 byte beyond the string boundary (both 'Path' and
'MapName' will be FS0: in this case).

This commit adds additional checks to avoid this.

Cc: Ruiyu Ni 
Cc: Jaben Carsey 
Cc: Steven Shi 
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu 
---
 ShellPkg/Application/Shell/ShellProtocol.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ShellPkg/Application/Shell/ShellProtocol.c 
b/ShellPkg/Application/Shell/ShellProtocol.c
index 40e5e653ae..5e34b8dad1 100644
--- a/ShellPkg/Application/Shell/ShellProtocol.c
+++ b/ShellPkg/Application/Shell/ShellProtocol.c
@@ -598,7 +598,8 @@ EfiShellGetDevicePathFromFilePath(
   //
   // build the full device path
   //
-  if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {
+  if ((*(Path+StrLen(MapName)) != CHAR_NULL) &&
+  (*(Path+StrLen(MapName)+1) == CHAR_NULL)) {
 DevicePathForReturn = FileDevicePath(Handle, L"\\");
   } else {
 DevicePathForReturn = FileDevicePath(Handle, Path+StrLen(MapName));
-- 
2.12.0.windows.1

___
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel