tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/DxePrintLibPrint2Protocol: Fix error in Precision position calculation 

Due to a potential hole in the stop condition of loop, the two continuous
access to ArgumentString (index, index+1) inside the loop might cause the
string ending character ('\0') and the byte after it to be read.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
This commit is contained in:
Jian J Wang 2017-12-28 10:22:39 +08:00 committed by Liming Gao
parent 6805854a73
commit 941b3c4845
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
MdeModulePkg/Library/DxePrintLibPrint2Protocol/PrintLib.c
View File

@ -2050,7 +2050,10 @@ InternalPrintLibSPrintMarker (
// Compute the number of characters in ArgumentString and store it in Count
// ArgumentString is either null-terminated, or it contains Precision characters
//
for (Count = 0; Count < Precision || ((Flags & PRECISION) == 0); Count++) {
for (Count = 0;
ArgumentString[Count * BytesPerArgumentCharacter] != '\0' &&
Count < Precision || ((Flags & PRECISION) == 0);
Count++) {
ArgumentCharacter = ((ArgumentString[Count * BytesPerArgumentCharacter] & 0xff) | ((ArgumentString[Count * BytesPerArgumentCharacter + 1]) << 8)) & ArgumentMask;
if (ArgumentCharacter == 0) {
break;
@ -2107,7 +2110,7 @@ InternalPrintLibSPrintMarker (
//
// Copy the string into the output buffer performing the required type conversions
//
while (Index < Count) {
while (Index < Count && (*ArgumentString) != '\0') {
ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
LengthToReturn += (1 * BytesPerOutputCharacter);