diff options
| author | Hao Wu <hao.a.wu@intel.com> | 2017-12-18 09:19:23 +0800 |
|---|---|---|
| committer | Hao Wu <hao.a.wu@intel.com> | 2017-12-25 09:54:34 +0800 |
| commit | 1c47ab04046d8a4123d4bcf8826f42aca2777292 (patch) | |
| tree | 94c0956b8f4043878c962742986d54034a177c0d | |
| parent | fc42d0e89002af2d23f83edb5b64d9a56e825922 (diff) | |
| download | edk2-1c47ab04046d8a4123d4bcf8826f42aca2777292.zip edk2-1c47ab04046d8a4123d4bcf8826f42aca2777292.tar.gz edk2-1c47ab04046d8a4123d4bcf8826f42aca2777292.tar.bz2 | |
BaseTools/GenVtf: Add/refine boundary checks for strcpy/strcat calls
Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
| -rw-r--r-- | BaseTools/Source/C/GenVtf/GenVtf.c | 43 |
1 files changed, 37 insertions, 6 deletions
diff --git a/BaseTools/Source/C/GenVtf/GenVtf.c b/BaseTools/Source/C/GenVtf/GenVtf.c index 2ae9a7b..65ae08e 100644 --- a/BaseTools/Source/C/GenVtf/GenVtf.c +++ b/BaseTools/Source/C/GenVtf/GenVtf.c @@ -362,10 +362,20 @@ Returns: }
} else if (strnicmp (*TokenStr, "COMP_BIN", 8) == 0) {
TokenStr++;
- strcpy (VtfInfo->CompBinName, *TokenStr);
+ if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+ Error (NULL, 0, 3000, "Invalid", "The 'COMP_BIN' name is too long.");
+ return ;
+ }
+ strncpy (VtfInfo->CompBinName, *TokenStr, FILE_NAME_SIZE - 1);
+ VtfInfo->CompBinName[FILE_NAME_SIZE - 1] = 0;
} else if (strnicmp (*TokenStr, "COMP_SYM", 8) == 0) {
TokenStr++;
- strcpy (VtfInfo->CompSymName, *TokenStr);
+ if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+ Error (NULL, 0, 3000, "Invalid", "The 'COMP_SYM' name is too long.");
+ return ;
+ }
+ strncpy (VtfInfo->CompSymName, *TokenStr, FILE_NAME_SIZE - 1);
+ VtfInfo->CompSymName[FILE_NAME_SIZE - 1] = 0;
} else if (strnicmp (*TokenStr, "COMP_SIZE", 9) == 0) {
TokenStr++;
if (strnicmp (*TokenStr, "-", 1) == 0) {
@@ -444,14 +454,24 @@ Returns: if (SectionOptionFlag) {
if (stricmp (*TokenStr, "IA32_RST_BIN") == 0) {
TokenStr++;
- strcpy (IA32BinFile, *TokenStr);
+ if (strlen (*TokenStr) >= FILE_NAME_SIZE) {
+ Error (NULL, 0, 3000, "Invalid", "The 'IA32_RST_BIN' name is too long.");
+ break;
+ }
+ strncpy (IA32BinFile, *TokenStr, FILE_NAME_SIZE - 1);
+ IA32BinFile[FILE_NAME_SIZE - 1] = 0;
}
}
if (SectionCompFlag) {
if (stricmp (*TokenStr, "COMP_NAME") == 0) {
TokenStr++;
- strcpy (FileListPtr->CompName, *TokenStr);
+ if (strlen (*TokenStr) >= COMPONENT_NAME_SIZE) {
+ Error (NULL, 0, 3000, "Invalid", "The 'COMP_NAME' name is too long.");
+ break;
+ }
+ strncpy (FileListPtr->CompName, *TokenStr, COMPONENT_NAME_SIZE - 1);
+ FileListPtr->CompName[COMPONENT_NAME_SIZE - 1] = 0;
TokenStr++;
ParseAndUpdateComponents (FileListPtr);
}
@@ -2240,9 +2260,20 @@ Returns: //
// Use the file name minus extension as the base for tokens
//
- strcpy (BaseToken, SourceFileName);
+ if (strlen (SourceFileName) >= MAX_LONG_FILE_PATH) {
+ fclose (SourceFile);
+ Error (NULL, 0, 2000, "Invalid parameter", "The source file name is too long.");
+ return EFI_ABORTED;
+ }
+ strncpy (BaseToken, SourceFileName, MAX_LONG_FILE_PATH - 1);
+ BaseToken[MAX_LONG_FILE_PATH - 1] = 0;
strtok (BaseToken, ". \t\n");
- strcat (BaseToken, "__");
+ if (strlen (BaseToken) + strlen ("__") >= MAX_LONG_FILE_PATH) {
+ fclose (SourceFile);
+ Error (NULL, 0, 2000, "Invalid parameter", "The source file name is too long.");
+ return EFI_ABORTED;
+ }
+ strncat (BaseToken, "__", MAX_LONG_FILE_PATH - strlen (BaseToken) - 1);
//
// Open the destination file
|