From 0cd35d739ea8c0096af0db7d920010593db5779f Mon Sep 17 00:00:00 2001 From: Hao Wu Date: Fri, 28 Aug 2015 07:41:38 +0000 Subject: MdePkg UefiDevicePathLib: Fix possible memory read/write cross boundary The SSID field of a Wi-Fi device path node may not contain a NULL termination. Additonal handle is added to make sure no cross-boundary memory read/write will occur. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu Reviewed-by: Feng Tian git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18355 6f19259b-4bc3-4df7-8a09-765794883524 --- MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c | 15 ++++++++++++--- MdePkg/Library/UefiDevicePathLib/DevicePathToText.c | 7 ++++++- 2 files changed, 18 insertions(+), 4 deletions(-) (limited to 'MdePkg/Library') diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c index 9c5436d337..6a9b389ca5 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c @@ -2827,7 +2827,8 @@ DevPathFromTextWiFi ( ) { CHAR16 *SSIdStr; - CHAR8 *AsciiStr; + CHAR8 AsciiStr[33]; + UINTN DataLen; WIFI_DEVICE_PATH *WiFiDp; SSIdStr = GetNextParamStr (&TextDeviceNode); @@ -2837,8 +2838,16 @@ DevPathFromTextWiFi ( (UINT16) sizeof (WIFI_DEVICE_PATH) ); - AsciiStr = (CHAR8 *) WiFiDp->SSId; - StrToAscii (SSIdStr, &AsciiStr); + if (NULL != SSIdStr) { + DataLen = StrLen (SSIdStr); + if (StrLen (SSIdStr) > 32) { + SSIdStr[32] = L'\0'; + DataLen = 32; + } + + UnicodeStrToAsciiStr (SSIdStr, AsciiStr); + CopyMem (WiFiDp->SSId, AsciiStr, DataLen); + } return (EFI_DEVICE_PATH_PROTOCOL *) WiFiDp; } diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c index 0774fd8c17..363830bd32 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c @@ -1616,9 +1616,14 @@ DevPathToTextWiFi ( ) { WIFI_DEVICE_PATH *WiFi; + UINT8 SSId[33]; WiFi = DevPath; - UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", WiFi->SSId); + + SSId[32] = '\0'; + CopyMem (SSId, WiFi->SSId, 32); + + UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", SSId); } /** -- cgit v1.2.3