diff options
| author | Hao Wu <hao.a.wu@intel.com> | 2017-09-19 16:42:04 +0800 |
|---|---|---|
| committer | Hao Wu <hao.a.wu@intel.com> | 2017-09-29 16:14:17 +0800 |
| commit | ea0b15067c54e8c34321e9f094515302039be12e (patch) | |
| tree | 0df74fd7e998ba813cb413bedfaaf410858500cf | |
| parent | 0e6584e38650cef9a6b4579553679c0f12d897bc (diff) | |
| download | edk2-ea0b15067c54e8c34321e9f094515302039be12e.zip edk2-ea0b15067c54e8c34321e9f094515302039be12e.tar.gz edk2-ea0b15067c54e8c34321e9f094515302039be12e.tar.bz2 | |
MdePkg/PrintLib: Fix possible negative value left shift
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=702
Within function InternalPrintLibSPrintMarker(), possible left shift of a
negative value is found in:
"(*(ArgumentString + 1) << 8)"
which involves undefined behavior.
Since '*(ArgumentString + 1)' is of type CONST CHAR8 (signed), it will be
promoted to type int (signed) during the left shift operation. If
'*(ArgumentString + 1)' is a negative value, the behavior will be
undefined.
According to the C11 spec, Section 6.5.7:
> 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated
> bits are filled with zeros. If E1 has an unsigned type, the value
> of the result is E1 * 2^E2 , reduced modulo one more than the
> maximum value representable in the result type. If E1 has a signed
> type and nonnegative value, and E1 * 2^E2 is representable in the
> result type, then that is the resulting value; otherwise, the
> behavior is undefined.
This commit explicitly cast '*(ArgumentString + 1)' with UINT8 to resolve
this issue.
Cc: Steven Shi <steven.shi@intel.com>
Cc: Michael Kinney <michael.d.kinney@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
| -rw-r--r-- | MdePkg/Library/BasePrintLib/PrintLibInternal.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/MdePkg/Library/BasePrintLib/PrintLibInternal.c b/MdePkg/Library/BasePrintLib/PrintLibInternal.c index cec5b3b..28d9464 100644 --- a/MdePkg/Library/BasePrintLib/PrintLibInternal.c +++ b/MdePkg/Library/BasePrintLib/PrintLibInternal.c @@ -1165,7 +1165,7 @@ BasePrintLibSPrintMarker ( // Copy the string into the output buffer performing the required type conversions
//
while (Index < Count) {
- ArgumentCharacter = ((*ArgumentString & 0xff) | (*(ArgumentString + 1) << 8)) & ArgumentMask;
+ ArgumentCharacter = ((*ArgumentString & 0xff) | (((UINT8)*(ArgumentString + 1)) << 8)) & ArgumentMask;
LengthToReturn += (1 * BytesPerOutputCharacter);
if ((Flags & COUNT_ONLY_NO_PRINT) == 0 && Buffer != NULL) {
|