diff options
| author | Ruiyu Ni <ruiyu.ni@intel.com> | 2017-07-26 16:21:54 +0800 |
|---|---|---|
| committer | Ruiyu Ni <ruiyu.ni@intel.com> | 2017-07-28 17:30:32 +0800 |
| commit | 4f0465058b6ff9c53591ec81951f494a70bde7c1 (patch) | |
| tree | 2581744073e34cdaa1f64545c121093efd0176dc | |
| parent | 1557f05b37f89d1f3cd41a5543a22533fc68ede6 (diff) | |
| download | edk2-4f0465058b6ff9c53591ec81951f494a70bde7c1.zip edk2-4f0465058b6ff9c53591ec81951f494a70bde7c1.tar.gz edk2-4f0465058b6ff9c53591ec81951f494a70bde7c1.tar.bz2 | |
ShellPkg: Avoid buffer out-of-bound access
PathSize is the number of bytes in PathForReturn buffer so
PathForReturn[PathSize - 1] incorrectly accesses the last
character in the buffer,
PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Steven Shi <steven.shi@intel.com>
| -rw-r--r-- | ShellPkg/Application/Shell/ShellProtocol.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c index b3b8acc..991fb58 100644 --- a/ShellPkg/Application/Shell/ShellProtocol.c +++ b/ShellPkg/Application/Shell/ShellProtocol.c @@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath( // UEFI Shell spec section 3.7)
if ((PathSize != 0) &&
(PathForReturn != NULL) &&
- (PathForReturn[PathSize - 1] != L'\\') &&
+ (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') &&
(AlignedNode->PathName[0] != L'\\')) {
PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1);
}
|