Please update copyright year for patch 1 and 2. With it addressed, Reviewed-by: Jian J Wang <jian.j.w...@intel.com>
Regards, Jian > -----Original Message----- > From: Bi, Dandan <dandan...@intel.com> > Sent: Thursday, February 13, 2020 12:03 PM > To: devel@edk2.groups.io > Cc: Gao, Liming <liming....@intel.com>; Dong, Eric <eric.d...@intel.com>; > Wang, Jian J <jian.j.w...@intel.com> > Subject: [patch 2/2] MdeModulePkg/DisplayEngine: Zero memory before free > (CVE-2019-14558) > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1611 > > Cc: Liming Gao <liming....@intel.com> > Cc: Eric Dong <eric.d...@intel.com> > Cc: Jian J Wang <jian.j.w...@intel.com> > Signed-off-by: Dandan Bi <dandan...@intel.com> > --- > MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c > b/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c > index 7d9486112b..1087004939 100644 > --- a/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c > +++ b/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c > @@ -821,10 +821,11 @@ PasswordProcess ( > // > // Old password exist, ask user for the old password > // > Status = ReadString (MenuOption, gPromptForPassword, StringPtr); > if (EFI_ERROR (Status)) { > + ZeroMem (StringPtr, (Maximum + 1) * sizeof (CHAR16)); > FreePool (StringPtr); > return Status; > } > > // > @@ -838,11 +839,11 @@ PasswordProcess ( > // > PasswordInvalid (); > } else { > Status = EFI_SUCCESS; > } > - > + ZeroMem (StringPtr, (Maximum + 1) * sizeof (CHAR16)); > FreePool (StringPtr); > return Status; > } > } > > @@ -854,10 +855,11 @@ PasswordProcess ( > if (EFI_ERROR (Status)) { > // > // Reset state machine for password > // > Question->PasswordCheck (gFormData, Question, NULL); > + ZeroMem (StringPtr, (Maximum + 1) * sizeof (CHAR16)); > FreePool (StringPtr); > return Status; > } > > // > @@ -869,10 +871,12 @@ PasswordProcess ( > if (EFI_ERROR (Status)) { > // > // Reset state machine for password > // > Question->PasswordCheck (gFormData, Question, NULL); > + ZeroMem (StringPtr, (Maximum + 1) * sizeof (CHAR16)); > + ZeroMem (TempString, (Maximum + 1) * sizeof (CHAR16)); > FreePool (StringPtr); > FreePool (TempString); > return Status; > } > > -- > 2.18.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#54337): https://edk2.groups.io/g/devel/message/54337 Mute This Topic: https://groups.io/mt/71232490/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
