Check we have any data left (Len > 0) before advancing the Data pointer and reducing Len. Avoids wrapping Len.
Also replace the AsciiStrLen() call with an open-coded loop which likewise checks Len to make sure we don't overrun the buffer. Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=4207 Reported-by: Jeremy Boone <jeremy.bo...@nccgroup.com> Signed-off-by: Gerd Hoffmann <kra...@redhat.com> --- NetworkPkg/IScsiDxe/IScsiProto.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/NetworkPkg/IScsiDxe/IScsiProto.c b/NetworkPkg/IScsiDxe/IScsiProto.c index ef587649a05e..88e7946d3f78 100644 --- a/NetworkPkg/IScsiDxe/IScsiProto.c +++ b/NetworkPkg/IScsiDxe/IScsiProto.c @@ -1903,9 +1903,8 @@ IScsiBuildKeyValueList ( Data++; } - if (*Data == '=') { + if ((Len > 0) && (*Data == '=')) { *Data = '\0'; - Data++; Len--; } else { @@ -1917,8 +1916,17 @@ IScsiBuildKeyValueList ( InsertTailList (ListHead, &KeyValuePair->List); - Data += AsciiStrLen (KeyValuePair->Value) + 1; - Len -= (UINT32)AsciiStrLen (KeyValuePair->Value) + 1; + while ((Len > 0) && (*Data != '\0')) { + Len--; + Data++; + } + + if ((Len > 0) && (*Data == '\0')) { + Data++; + Len--; + } else { + goto ON_ERROR; + } } return ListHead; -- 2.41.0 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#106280): https://edk2.groups.io/g/devel/message/106280 Mute This Topic: https://groups.io/mt/99694846/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
