diff options
| author | Hao Wu <hao.a.wu@intel.com> | 2015-07-13 01:23:37 +0000 |
|---|---|---|
| committer | hwu1225 <hwu1225@Edk2> | 2015-07-13 01:23:37 +0000 |
| commit | 577870d5603dca32d878e9908a7ec4d2852b590a (patch) | |
| tree | 31ec7cefa0ddc37b875a4fe7e673aee1195e1e94 /IntelFrameworkModulePkg | |
| parent | a3c9617ea6a02c2ac747cf274fe9025f2d42c9bb (diff) | |
| download | edk2-577870d5603dca32d878e9908a7ec4d2852b590a.tar.gz edk2-577870d5603dca32d878e9908a7ec4d2852b590a.tar.bz2 edk2-577870d5603dca32d878e9908a7ec4d2852b590a.zip | |
IntelFrameworkModulePkg BootMngr: Fix potential read over memory boundary
This commit will resolve the issue brought by r17737.
HelpString = AllocateCopyPool (HelpSize, L"Device Path : ");
The above using of AllocateCopyPool() will read contents out of the scope
of the constant string. Potential risk for the constant string allocated
at the boundary of memory region.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Jeff Fan <jeff.fan@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17932 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'IntelFrameworkModulePkg')
| -rw-r--r-- | IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c index 978959d6e7..6efd783ab2 100644 --- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c +++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMngr/BootManager.c @@ -319,8 +319,9 @@ CallBootManager ( TempStr = DevicePathToStr (Option->DevicePath);
HelpSize = StrSize (TempStr) + StrSize (L"Device Path : ");
- HelpString = AllocateCopyPool (HelpSize, L"Device Path : ");
+ HelpString = AllocateZeroPool (HelpSize);
ASSERT (HelpString != NULL);
+ StrCatS (HelpString, HelpSize / sizeof (CHAR16), L"Device Path : ");
StrCatS (HelpString, HelpSize / sizeof (CHAR16), TempStr);
HelpToken = HiiSetString (HiiHandle, 0, HelpString, NULL);
|