tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-28 16:14:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

IntelFrameworkModulePkg GenericBdsLib: Potential read over memory boudary

Browse Source 
This commit will resolve the issue brought by r17733.

StringBuffer1 = AllocateCopyPool (
                  MAX_STRING_LEN * sizeof (CHAR16),
                  L"Configuration changed. Reset to apply it Now."
                  );

The above using of AllocateCopyPool() will read contents out of the scope
of the constant string. Potential risk for the constant string allocated
at the boundary of memory region.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Jeff Fan <jeff.fan@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17929 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Hao Wu 2015-07-13 01:22:21 +00:00 committed by hwu1225
parent d5b5b8f8aa
commit 885c3060c1
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c
View File

@ -1127,16 +1127,20 @@ SetupResetReminder (
if (IsResetReminderFeatureEnable ()) {
if (IsResetRequired ()) {
StringBuffer1 = AllocateCopyPool (
MAX_STRING_LEN * sizeof (CHAR16),
L"Configuration changed. Reset to apply it Now."
);
StringBuffer1 = AllocateZeroPool (MAX_STRING_LEN * sizeof (CHAR16));
ASSERT (StringBuffer1 != NULL);
StringBuffer2 = AllocateCopyPool (
MAX_STRING_LEN * sizeof (CHAR16),
L"Press ENTER to reset"
);
StringBuffer2 = AllocateZeroPool (MAX_STRING_LEN * sizeof (CHAR16));
ASSERT (StringBuffer2 != NULL);
StrCpyS (
StringBuffer1,
MAX_STRING_LEN,
L"Configuration changed. Reset to apply it Now."
);
StrCpyS (
StringBuffer2,
MAX_STRING_LEN,
L"Press ENTER to reset"
);
//
// Popup a menu to notice user
//