tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdePkg UefiDevicePathLib: Fix possible memory read/write cross boundary 

The SSID field of a Wi-Fi device path node may not contain a NULL
termination.

Additonal handle is added to make sure no cross-boundary memory read/write
will occur.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18355 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Hao Wu 2015-08-28 07:41:38 +00:00 committed by hwu1225
parent a5cb7c824e
commit 0cd35d739e
2 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c
View File

@ -2827,7 +2827,8 @@ DevPathFromTextWiFi (
)
{
CHAR16 *SSIdStr;
CHAR8 *AsciiStr;
CHAR8 AsciiStr[33];
UINTN DataLen;
WIFI_DEVICE_PATH *WiFiDp;
SSIdStr = GetNextParamStr (&TextDeviceNode);
@ -2837,8 +2838,16 @@ DevPathFromTextWiFi (
(UINT16) sizeof (WIFI_DEVICE_PATH)
);
AsciiStr = (CHAR8 *) WiFiDp->SSId;
StrToAscii (SSIdStr, &AsciiStr);
if (NULL != SSIdStr) {
DataLen = StrLen (SSIdStr);
if (StrLen (SSIdStr) > 32) {
SSIdStr[32] = L'\0';
DataLen = 32;
}
UnicodeStrToAsciiStr (SSIdStr, AsciiStr);
CopyMem (WiFiDp->SSId, AsciiStr, DataLen);
}
return (EFI_DEVICE_PATH_PROTOCOL *) WiFiDp;
}

7
MdePkg/Library/UefiDevicePathLib/DevicePathToText.c
View File

@ -1616,9 +1616,14 @@ DevPathToTextWiFi (
)
{
WIFI_DEVICE_PATH *WiFi;
UINT8 SSId[33];
WiFi = DevPath;
UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", WiFi->SSId);
SSId[32] = '\0';
CopyMem (SSId, WiFi->SSId, 32);
UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", SSId);
}
/**