tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ShellPkg: Fix buffer overflow issue in 'map' command. 

This patch replace 'StrnCat' with 'StrnCatS' to avoid the buffer overflow in 'map.c'.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17387 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Qiu Shumin 2015-05-11 01:44:35 +00:00 committed by shenshushi
parent 1e834a6f30
commit db906063a7
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
View File

@ -2,7 +2,7 @@
Main file for map shell level 2 command. Main file for map shell level 2 command.
(C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.<BR> (C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.<BR>
Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -224,6 +224,8 @@ MappingListHasType(
) )
{ {
CHAR16 *NewSpecific; CHAR16 *NewSpecific;
RETURN_STATUS Status;
// //
// specific has priority // specific has priority
// //
@ -233,7 +235,11 @@ MappingListHasType(
return FALSE; return FALSE;
} }
if (NewSpecific[StrLen(NewSpecific)-1] != L':') { if (NewSpecific[StrLen(NewSpecific)-1] != L':') {
StrnCat(NewSpecific, L":", 2); Status = StrnCatS(NewSpecific, (StrSize(Specific) + sizeof(CHAR16))/sizeof(CHAR16), L":", StrLen(L":"));
if (EFI_ERROR (Status)) {
FreePool(NewSpecific);
return FALSE;
}
} }
if (SearchList(MapList, NewSpecific, NULL, TRUE, FALSE, L";")) { if (SearchList(MapList, NewSpecific, NULL, TRUE, FALSE, L";")) {
@ -875,13 +881,18 @@ AddMappingFromMapping(
CONST EFI_DEVICE_PATH_PROTOCOL *DevPath; CONST EFI_DEVICE_PATH_PROTOCOL *DevPath;
EFI_STATUS Status; EFI_STATUS Status;
CHAR16 *NewSName; CHAR16 *NewSName;
RETURN_STATUS StrRetStatus;
NewSName = AllocateCopyPool(StrSize(SName) + sizeof(CHAR16), SName); NewSName = AllocateCopyPool(StrSize(SName) + sizeof(CHAR16), SName);
if (NewSName == NULL) { if (NewSName == NULL) {
return (SHELL_OUT_OF_RESOURCES); return (SHELL_OUT_OF_RESOURCES);
} }
if (NewSName[StrLen(NewSName)-1] != L':') { if (NewSName[StrLen(NewSName)-1] != L':') {
StrnCat(NewSName, L":", 2); StrRetStatus = StrnCatS(NewSName, (StrSize(SName) + sizeof(CHAR16))/sizeof(CHAR16), L":", StrLen(L":"));
if (EFI_ERROR(StrRetStatus)) {
FreePool(NewSName);
return ((SHELL_STATUS) (StrRetStatus & (~MAX_BIT)));
}
} }
if (!IsNumberLetterOnly(NewSName, StrLen(NewSName)-1)) { if (!IsNumberLetterOnly(NewSName, StrLen(NewSName)-1)) {
@ -927,13 +938,18 @@ AddMappingFromHandle(
EFI_DEVICE_PATH_PROTOCOL *DevPath; EFI_DEVICE_PATH_PROTOCOL *DevPath;
EFI_STATUS Status; EFI_STATUS Status;
CHAR16 *NewSName; CHAR16 *NewSName;
RETURN_STATUS StrRetStatus;
NewSName = AllocateCopyPool(StrSize(SName) + sizeof(CHAR16), SName); NewSName = AllocateCopyPool(StrSize(SName) + sizeof(CHAR16), SName);
if (NewSName == NULL) { if (NewSName == NULL) {
return (SHELL_OUT_OF_RESOURCES); return (SHELL_OUT_OF_RESOURCES);
} }
if (NewSName[StrLen(NewSName)-1] != L':') { if (NewSName[StrLen(NewSName)-1] != L':') {
StrnCat(NewSName, L":", 2); StrRetStatus = StrnCatS(NewSName, (StrSize(SName) + sizeof(CHAR16))/sizeof(CHAR16), L":", StrLen(L":"));
if (EFI_ERROR(StrRetStatus)) {
FreePool(NewSName);
return ((SHELL_STATUS) (StrRetStatus & (~MAX_BIT)));
}
} }
if (!IsNumberLetterOnly(NewSName, StrLen(NewSName)-1)) { if (!IsNumberLetterOnly(NewSName, StrLen(NewSName)-1)) {