tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

BaseTools/GenBootSector: Add/refine boundary checks for strcpy/strcat 

Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.

Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
This commit is contained in:
Hao Wu 2017-12-18 09:17:52 +08:00
parent 52e8c56838
commit 1bdd9465c1
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
BaseTools/Source/C/GenBootSector/GenBootSector.c
View File

@ -4,7 +4,7 @@ Reading/writing MBR/DBR.
If we write MBR to disk, we just update the MBR code and the partition table wouldn't be over written. If we write MBR to disk, we just update the MBR code and the partition table wouldn't be over written.
If we process DBR, we will patch MBR to set first partition active if no active partition exists. If we process DBR, we will patch MBR to set first partition active if no active partition exists.
Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR> Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -631,6 +631,14 @@ GetPathInfo (
return ErrorSuccess; return ErrorSuccess;
} }
//
// Check the path length
//
if (strlen (PathInfo->Path) >= (sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]))) {
fprintf (stderr, "ERROR, Path is too long for - %s", PathInfo->Path);
return ErrorPath;
}
PathInfo->Type = PathFile; PathInfo->Type = PathFile;
if (PathInfo->Input) { if (PathInfo->Input) {
// //
@ -644,7 +652,12 @@ GetPathInfo (
fclose (f); fclose (f);
} }
PathInfo->Type = PathFile; PathInfo->Type = PathFile;
strcpy(PathInfo->PhysicalPath, PathInfo->Path); strncpy(
PathInfo->PhysicalPath,
PathInfo->Path,
sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]) - 1
);
PathInfo->PhysicalPath[sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]) - 1] = 0;
return ErrorSuccess; return ErrorSuccess;
} }