tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ShellPkg: Avoid buffer out-of-bound access 

PathSize is the number of bytes in PathForReturn buffer so
PathForReturn[PathSize - 1] incorrectly accesses the last
character in the buffer,
PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Steven Shi <steven.shi@intel.com>
This commit is contained in:
Ruiyu Ni 2017-07-26 16:21:54 +08:00
parent 1557f05b37
commit 4f0465058b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ShellPkg/Application/Shell/ShellProtocol.c
View File

@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath(
// UEFI Shell spec section 3.7) // UEFI Shell spec section 3.7)
if ((PathSize != 0) && if ((PathSize != 0) &&
(PathForReturn != NULL) && (PathForReturn != NULL) &&
(PathForReturn[PathSize - 1] != L'\\') && (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') &&
(AlignedNode->PathName[0] != L'\\')) { (AlignedNode->PathName[0] != L'\\')) {
PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1); PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1);
} }