From 49264dac6ea49faa0307a57c49d0611a2055d292 Mon Sep 17 00:00:00 2001 From: Hao Wu Date: Tue, 30 Jun 2015 06:27:18 +0000 Subject: [PATCH] IntelFrameworkModulePkg BootMaint: Use safe string functions Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu Reviewed-by: Jeff Fan Reviewed-by: Jaben Carsey git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17736 6f19259b-4bc3-4df7-8a09-765794883524 --- .../Universal/BdsDxe/BootMaint/BootOption.c | 31 +++++++++---------- .../Universal/BdsDxe/BootMaint/FormGuid.h | 16 +++++++--- .../Universal/BdsDxe/BootMaint/UpdatePage.c | 4 +-- .../Universal/BdsDxe/BootMaint/Variable.c | 10 ++++-- 4 files changed, 35 insertions(+), 26 deletions(-) diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/BootOption.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/BootOption.c index 0a6a445f0b..1519315d40 100644 --- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/BootOption.c +++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/BootOption.c @@ -5,7 +5,7 @@ Boot option manipulation -Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -1010,11 +1010,9 @@ BOpt_GetBootOptions ( StringSize = StrSize((UINT16*)LoadOptionPtr); - NewLoadContext->Description = AllocateZeroPool (StrSize((UINT16*)LoadOptionPtr)); - ASSERT (NewLoadContext->Description != NULL); - StrCpy (NewLoadContext->Description, (UINT16*)LoadOptionPtr); - + NewLoadContext->Description = AllocateCopyPool (StrSize((UINT16*)LoadOptionPtr), LoadOptionPtr); ASSERT (NewLoadContext->Description != NULL); + NewMenuEntry->DisplayString = NewLoadContext->Description; LoadOptionPtr += StringSize; @@ -1089,6 +1087,7 @@ BOpt_AppendFileName ( { UINTN Size1; UINTN Size2; + UINTN MaxLen; CHAR16 *Str; CHAR16 *TmpStr; CHAR16 *Ptr; @@ -1096,18 +1095,18 @@ BOpt_AppendFileName ( Size1 = StrSize (Str1); Size2 = StrSize (Str2); - Str = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16)); + MaxLen = (Size1 + Size2 + sizeof (CHAR16)) / sizeof (CHAR16); + Str = AllocateCopyPool (MaxLen * sizeof (CHAR16), Str1); ASSERT (Str != NULL); - TmpStr = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16)); + TmpStr = AllocateZeroPool (MaxLen * sizeof (CHAR16)); ASSERT (TmpStr != NULL); - StrCat (Str, Str1); if (!((*Str == '\\') && (*(Str + 1) == 0))) { - StrCat (Str, L"\\"); + StrCatS (Str, MaxLen, L"\\"); } - StrCat (Str, Str2); + StrCatS (Str, MaxLen, Str2); Ptr = Str; LastSlash = Str; @@ -1120,11 +1119,11 @@ BOpt_AppendFileName ( // // - // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings + // Use TmpStr as a backup, as StrCpyS in BaseLib does not handle copy of two strings // that overlap. // - StrCpy (TmpStr, Ptr + 3); - StrCpy (LastSlash, TmpStr); + StrCpyS (TmpStr, MaxLen, Ptr + 3); + StrCpyS (LastSlash, MaxLen - (UINTN) (LastSlash - Str), TmpStr); Ptr = LastSlash; } else if (*Ptr == '\\' && *(Ptr + 1) == '.' && *(Ptr + 2) == '\\') { // @@ -1132,11 +1131,11 @@ BOpt_AppendFileName ( // // - // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings + // Use TmpStr as a backup, as StrCpyS in BaseLib does not handle copy of two strings // that overlap. // - StrCpy (TmpStr, Ptr + 2); - StrCpy (Ptr, TmpStr); + StrCpyS (TmpStr, MaxLen, Ptr + 2); + StrCpyS (Ptr, MaxLen - (UINTN) (Ptr - Str), TmpStr); Ptr = LastSlash; } else if (*Ptr == '\\') { LastSlash = Ptr; diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/FormGuid.h b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/FormGuid.h index f2e1866845..bf99999760 100644 --- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/FormGuid.h +++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/FormGuid.h @@ -1,7 +1,7 @@ /** @file Formset guids, form id and VarStore data structure for Boot Maintenance Manager. -Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -219,14 +219,20 @@ typedef struct { #define KEY_VALUE_SAVE_AND_EXIT_DRIVER 0x1002 #define KEY_VALUE_NO_SAVE_AND_EXIT_DRIVER 0x1003 +// +// Description data and optional data size +// +#define DESCRIPTION_DATA_SIZE 75 +#define OPTIONAL_DATA_SIZE 127 + /// /// This is the data structure used by File Explorer formset /// typedef struct { - UINT16 BootDescriptionData[75]; - UINT16 BootOptionalData[127]; - UINT16 DriverDescriptionData[75]; - UINT16 DriverOptionalData[127]; + UINT16 BootDescriptionData[DESCRIPTION_DATA_SIZE]; + UINT16 BootOptionalData[OPTIONAL_DATA_SIZE]; + UINT16 DriverDescriptionData[DESCRIPTION_DATA_SIZE]; + UINT16 DriverOptionalData[OPTIONAL_DATA_SIZE]; BOOLEAN BootOptionChanged; BOOLEAN DriverOptionChanged; UINT8 Active; diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c index 7d5861e9fe..b13ed11630 100644 --- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c +++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c @@ -1,7 +1,7 @@ /** @file Dynamically update the pages. -Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -830,7 +830,7 @@ UpdateConModePage ( // UnicodeValueToString (ModeString, 0, Col, 0); PStr = &ModeString[0]; - StrnCat (PStr, L" x ", StrLen(L" x ") + 1); + StrCatS (PStr, sizeof (ModeString) / sizeof (ModeString[0]), L" x "); PStr = PStr + StrLen (PStr); UnicodeValueToString (PStr , 0, Row, 0); diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/Variable.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/Variable.c index e4299ff6cb..616549e64a 100644 --- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/Variable.c +++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/Variable.c @@ -1,7 +1,7 @@ /** @file Variable operation that will be used by bootmaint -Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -579,7 +579,7 @@ Var_UpdateDriverOption ( ); if (*DescriptionData == 0x0000) { - StrCpy (DescriptionData, DriverString); + StrCpyS (DescriptionData, DESCRIPTION_DATA_SIZE, DriverString); } BufferSize = sizeof (UINT32) + sizeof (UINT16) + StrSize (DescriptionData); @@ -763,7 +763,11 @@ Var_UpdateBootOption ( UnicodeSPrint (BootString, sizeof (BootString), L"Boot%04x", Index); if (NvRamMap->BootDescriptionData[0] == 0x0000) { - StrCpy (NvRamMap->BootDescriptionData, BootString); + StrCpyS ( + NvRamMap->BootDescriptionData, + sizeof (NvRamMap->BootDescriptionData) / sizeof (NvRamMap->BootDescriptionData[0]), + BootString + ); } BufferSize = sizeof (UINT32) + sizeof (UINT16) + StrSize (NvRamMap->BootDescriptionData);