On 08/24/20 18:18, Laszlo Ersek wrote: > On 07/03/20 04:30, Zhiguang Liu wrote: >> Reviewed-by: Zhiguang Liu <[email protected]> > > Merged as commit 4535fc312b76, via > <https://github.com/tianocore/edk2/pull/896>.
The commit message does not mention a TianoCore BZ. If there *is* an associated TianoCore BZ, please set it to RESOLVED|FIXED now, and also mark the above commit hash in a comment on it. Thanks Laszlo > > Thanks, > Laszlo > >> >>> -----Original Message----- >>> From: [email protected] <[email protected]> On Behalf Of Vladimir >>> Olovyannikov via groups.io >>> Sent: Thursday, July 2, 2020 10:31 AM >>> To: [email protected] >>> Cc: Vladimir Olovyannikov <[email protected]>; Kinney, >>> Michael D <[email protected]>; Gao, Liming >>> <[email protected]>; Liu, Zhiguang <[email protected]> >>> Subject: [edk2-devel] [PATCH v2 1/1] MdePkg : UefiFileHandleLib: fix buffer >>> overrun in FileHandleReadLine() >>> >>> If the size of the supplied buffer in FileHandleReadLine(), module >>> UefiFileHandleLib.c, was not 0, but was not enough to fit in >>> the line, the size is increased, and then the Buffer of the new >>> size is zeroed. This size is always larger than the supplied buffer size, >>> causing supplied buffer overrun. Fix the issue by using the >>> supplied buffer size in ZeroMem(). >>> >>> Signed-off-by: Vladimir Olovyannikov >>> <[email protected]> >>> Cc: Michael D Kinney <[email protected]> >>> Cc: Liming Gao <[email protected]> >>> Cc: Zhiguang Liu <[email protected]> >>> --- >>> MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c | 6 ++++-- >>> 1 file changed, 4 insertions(+), 2 deletions(-) >>> >>> diff --git a/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c >>> b/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c >>> index 28e28e5f67d5..ab34e6ccd5f4 100644 >>> --- a/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c >>> +++ b/MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.c >>> @@ -969,6 +969,7 @@ FileHandleReadLine( >>> UINTN CharSize; >>> >>> UINTN CountSoFar; >>> >>> UINTN CrCount; >>> >>> + UINTN OldSize; >>> >>> UINT64 OriginalFilePosition; >>> >>> >>> >>> if (Handle == NULL >>> >>> @@ -1039,10 +1040,11 @@ FileHandleReadLine( >>> // if we ran out of space tell when... >>> >>> // >>> >>> if ((CountSoFar+1-CrCount)*sizeof(CHAR16) > *Size){ >>> >>> + OldSize = *Size; >>> >>> *Size = (CountSoFar+1-CrCount)*sizeof(CHAR16); >>> >>> if (!Truncate) { >>> >>> - if (Buffer != NULL && *Size != 0) { >>> >>> - ZeroMem(Buffer, *Size); >>> >>> + if (Buffer != NULL && OldSize != 0) { >>> >>> + ZeroMem(Buffer, OldSize); >>> >>> } >>> >>> FileHandleSetPosition(Handle, OriginalFilePosition); >>> >>> return (EFI_BUFFER_TOO_SMALL); >>> >>> -- >>> 2.26.2.266.ge870325ee8 > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64577): https://edk2.groups.io/g/devel/message/64577 Mute This Topic: https://groups.io/mt/75251007/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
