Revision: 17387
http://sourceforge.net/p/edk2/code/17387
Author: shenshushi
Date: 2015-05-11 01:44:35 +0000 (Mon, 11 May 2015)
Log Message:
-----------
ShellPkg: Fix buffer overflow issue in 'map' command.
This patch replace 'StrnCat' with 'StrnCatS' to avoid the buffer overflow in
'map.c'.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qiu Shumin <shumin....@intel.com>
Reviewed-by: Jaben Carsey <jaben.car...@intel.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Modified Paths:
--------------
trunk/edk2/ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
Modified: trunk/edk2/ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
===================================================================
--- trunk/edk2/ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
2015-05-11 01:35:29 UTC (rev 17386)
+++ trunk/edk2/ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c
2015-05-11 01:44:35 UTC (rev 17387)
@@ -2,7 +2,7 @@
Main file for map shell level 2 command.
(C) Copyright 2013-2015 Hewlett-Packard Development Company, L.P.<BR>
- Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD
License
which accompanies this distribution. The full text of the license may be
found at
@@ -224,6 +224,8 @@
)
{
CHAR16 *NewSpecific;
+ RETURN_STATUS Status;
+
//
// specific has priority
//
@@ -233,7 +235,11 @@
return FALSE;
}
if (NewSpecific[StrLen(NewSpecific)-1] != L':') {
- StrnCat(NewSpecific, L":", 2);
+ Status = StrnCatS(NewSpecific, (StrSize(Specific) +
sizeof(CHAR16))/sizeof(CHAR16), L":", StrLen(L":"));
+ if (EFI_ERROR (Status)) {
+ FreePool(NewSpecific);
+ return FALSE;
+ }
}
if (SearchList(MapList, NewSpecific, NULL, TRUE, FALSE, L";")) {
@@ -875,13 +881,18 @@
CONST EFI_DEVICE_PATH_PROTOCOL *DevPath;
EFI_STATUS Status;
CHAR16 *NewSName;
+ RETURN_STATUS StrRetStatus;
NewSName = AllocateCopyPool(StrSize(SName) + sizeof(CHAR16), SName);
if (NewSName == NULL) {
return (SHELL_OUT_OF_RESOURCES);
}
if (NewSName[StrLen(NewSName)-1] != L':') {
- StrnCat(NewSName, L":", 2);
+ StrRetStatus = StrnCatS(NewSName, (StrSize(SName) +
sizeof(CHAR16))/sizeof(CHAR16), L":", StrLen(L":"));
+ if (EFI_ERROR(StrRetStatus)) {
+ FreePool(NewSName);
+ return ((SHELL_STATUS) (StrRetStatus & (~MAX_BIT)));
+ }
}
if (!IsNumberLetterOnly(NewSName, StrLen(NewSName)-1)) {
@@ -927,13 +938,18 @@
EFI_DEVICE_PATH_PROTOCOL *DevPath;
EFI_STATUS Status;
CHAR16 *NewSName;
+ RETURN_STATUS StrRetStatus;
NewSName = AllocateCopyPool(StrSize(SName) + sizeof(CHAR16), SName);
if (NewSName == NULL) {
return (SHELL_OUT_OF_RESOURCES);
}
if (NewSName[StrLen(NewSName)-1] != L':') {
- StrnCat(NewSName, L":", 2);
+ StrRetStatus = StrnCatS(NewSName, (StrSize(SName) +
sizeof(CHAR16))/sizeof(CHAR16), L":", StrLen(L":"));
+ if (EFI_ERROR(StrRetStatus)) {
+ FreePool(NewSName);
+ return ((SHELL_STATUS) (StrRetStatus & (~MAX_BIT)));
+ }
}
if (!IsNumberLetterOnly(NewSName, StrLen(NewSName)-1)) {
------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
_______________________________________________
edk2-commits mailing list
edk2-commits@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/edk2-commits
