summaryrefslogtreecommitdiffstats
path: root/ShellPkg
diff options
context:
space:
mode:
authorRuiyu Ni <ruiyu.ni@intel.com>2017-07-26 16:21:54 +0800
committerRuiyu Ni <ruiyu.ni@intel.com>2017-07-28 17:30:32 +0800
commit4f0465058b6ff9c53591ec81951f494a70bde7c1 (patch)
tree2581744073e34cdaa1f64545c121093efd0176dc /ShellPkg
parent1557f05b37f89d1f3cd41a5543a22533fc68ede6 (diff)
downloadedk2-4f0465058b6ff9c53591ec81951f494a70bde7c1.tar.gz
edk2-4f0465058b6ff9c53591ec81951f494a70bde7c1.tar.bz2
edk2-4f0465058b6ff9c53591ec81951f494a70bde7c1.zip
ShellPkg: Avoid buffer out-of-bound access
PathSize is the number of bytes in PathForReturn buffer so PathForReturn[PathSize - 1] incorrectly accesses the last character in the buffer, PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com> Reviewed-by: Steven Shi <steven.shi@intel.com>
Diffstat (limited to 'ShellPkg')
-rw-r--r--ShellPkg/Application/Shell/ShellProtocol.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c
index b3b8acc0d0..991fb58ca7 100644
--- a/ShellPkg/Application/Shell/ShellProtocol.c
+++ b/ShellPkg/Application/Shell/ShellProtocol.c
@@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath(
// UEFI Shell spec section 3.7)
if ((PathSize != 0) &&
(PathForReturn != NULL) &&
- (PathForReturn[PathSize - 1] != L'\\') &&
+ (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') &&
(AlignedNode->PathName[0] != L'\\')) {
PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1);
}