tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/PrintLib: Avoid reading content beyond the format string 

https://bugzilla.tianocore.org/show_bug.cgi?id=567

In functions DxePrintLibPrint2ProtocolVaListToBaseList() and
InternalPrintLibSPrintMarker(), when processing ASCII format strings, if
the format string walker pointer 'Format' is pointing at the end of the
format string (i.e. '\0'), the following expression:
*(Format + 1)
will read an undefined value.

Though this value won't affect the functionality, since it will be masked
by variable 'FormatMask':
(*(Format + 1) << 8)) & FormatMask
(FormatMask is 0xff for ASCII format string)

This commit adds additional logic to avoid reading undefined content.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
This commit is contained in:
Hao Wu 2017-05-22 15:03:24 +08:00
parent b1d4b9651e
commit 213da0b540
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
View File

@ -130,7 +130,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList (
//
// Get the first character from the format string
//
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
while (FormatCharacter != 0) {
if (FormatCharacter == '%') {
@ -148,7 +148,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList (
//
// Get the next character from the format string
//
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
switch (FormatCharacter) {
case '.':
@ -239,7 +239,7 @@ DxePrintLibPrint2ProtocolVaListToBaseList (
//
// Get the next character from the format string
//
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
}
return TRUE;
}
@ -1596,7 +1596,7 @@ InternalPrintLibSPrintMarker (
//
// Get the first character from the format string
//
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
//
// Loop until the end of the format string is reached or the output buffer is full
@ -1628,7 +1628,7 @@ InternalPrintLibSPrintMarker (
//
for (Done = FALSE; !Done; ) {
Format += BytesPerFormatCharacter;
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
switch (FormatCharacter) {
case '.':
Flags |= PRECISION;
@ -1681,7 +1681,7 @@ InternalPrintLibSPrintMarker (
for (Count = 0; ((FormatCharacter >= '0') && (FormatCharacter <= '9')); ){
Count = (Count * 10) + FormatCharacter - '0';
Format += BytesPerFormatCharacter;
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
}
Format -= BytesPerFormatCharacter;
if ((Flags & PRECISION) == 0) {
@ -1960,7 +1960,7 @@ InternalPrintLibSPrintMarker (
case '\r':
Format += BytesPerFormatCharacter;
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
if (FormatCharacter == '\n') {
//
// Translate '\r\n' to '\r\n'
@ -1981,7 +1981,7 @@ InternalPrintLibSPrintMarker (
//
ArgumentString = "\r\n";
Format += BytesPerFormatCharacter;
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
if (FormatCharacter != '\r') {
Format -= BytesPerFormatCharacter;
}
@ -2000,7 +2000,7 @@ InternalPrintLibSPrintMarker (
case '\r':
Format += BytesPerFormatCharacter;
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
if (FormatCharacter == '\n') {
//
// Translate '\r\n' to '\r\n'
@ -2021,7 +2021,7 @@ InternalPrintLibSPrintMarker (
//
ArgumentString = "\r\n";
Format += BytesPerFormatCharacter;
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
if (FormatCharacter != '\r') {
Format -= BytesPerFormatCharacter;
}
@ -2149,7 +2149,7 @@ InternalPrintLibSPrintMarker (
//
// Get the next character from the format string
//
FormatCharacter = ((*Format & 0xff) | (*(Format + 1) << 8)) & FormatMask;
FormatCharacter = ((*Format & 0xff) | ((BytesPerFormatCharacter == 1) ? 0 : (*(Format + 1) << 8))) & FormatMask;
}
if ((Flags & COUNT_ONLY_NO_PRINT) != 0) {