From ea0b15067c54e8c34321e9f094515302039be12e Mon Sep 17 00:00:00 2001 From: Hao Wu Date: Tue, 19 Sep 2017 16:42:04 +0800 Subject: [PATCH] MdePkg/PrintLib: Fix possible negative value left shift REF: https://bugzilla.tianocore.org/show_bug.cgi?id=702 Within function InternalPrintLibSPrintMarker(), possible left shift of a negative value is found in: "(*(ArgumentString + 1) << 8)" which involves undefined behavior. Since '*(ArgumentString + 1)' is of type CONST CHAR8 (signed), it will be promoted to type int (signed) during the left shift operation. If '*(ArgumentString + 1)' is a negative value, the behavior will be undefined. According to the C11 spec, Section 6.5.7: > 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated > bits are filled with zeros. If E1 has an unsigned type, the value > of the result is E1 * 2^E2 , reduced modulo one more than the > maximum value representable in the result type. If E1 has a signed > type and nonnegative value, and E1 * 2^E2 is representable in the > result type, then that is the resulting value; otherwise, the > behavior is undefined. This commit explicitly cast '*(ArgumentString + 1)' with UINT8 to resolve this issue. Cc: Steven Shi Cc: Michael Kinney Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu Reviewed-by: Liming Gao --- MdePkg/Library/BasePrintLib/PrintLibInternal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c b/MdePkg/Library/BasePrintLib/PrintLibInternal.c index cec5b3bc99..28d946472f 100644 --- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c +++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c @@ -1165,7 +1165,7 @@ BasePrintLibSPrintMarker ( // Copy the string into the output buffer performing the required type conversions // while (Index < Count) { - ArgumentCharacter = ((*ArgumentString & 0xff) | (*(ArgumentString + 1) << 8)) & ArgumentMask; + ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask; LengthToReturn += (1 * BytesPerOutputCharacter); if ((Flags & COUNT_ONLY_NO_PRINT) == 0 && Buffer != NULL) {