From 8c3e4688e0d8e6c218a98855d98976ce46dbb29e Mon Sep 17 00:00:00 2001 From: Hao Wu Date: Tue, 19 Sep 2017 10:22:21 +0800 Subject: ShellPkg/Shell: Avoid reading content beyond string boundary REF: https://bugzilla.tianocore.org/show_bug.cgi?id=690 Within function EfiShellGetDevicePathFromFilePath(), when the input parameter 'Path' string is like: "FS0:" It is possible for the below statement: "if (*(Path+StrLen(MapName)+1) == CHAR_NULL) {" to read the content 1 byte beyond the string boundary (both 'Path' and 'MapName' will be FS0: in this case). This commit adds additional checks to avoid this. Cc: Steven Shi Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu Reviewed-by: Jaben Carsey Reviewed-by: Ruiyu Ni --- ShellPkg/Application/Shell/ShellProtocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'ShellPkg/Application') diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c index 40e5e653ae..5e34b8dad1 100644 --- a/ShellPkg/Application/Shell/ShellProtocol.c +++ b/ShellPkg/Application/Shell/ShellProtocol.c @@ -598,7 +598,8 @@ EfiShellGetDevicePathFromFilePath( // // build the full device path // - if (*(Path+StrLen(MapName)+1) == CHAR_NULL) { + if ((*(Path+StrLen(MapName)) != CHAR_NULL) && + (*(Path+StrLen(MapName)+1) == CHAR_NULL)) { DevicePathForReturn = FileDevicePath(Handle, L"\\"); } else { DevicePathForReturn = FileDevicePath(Handle, Path+StrLen(MapName)); -- cgit v1.2.3