BaseTools/VfrCompile: Add/refine boundary checks for strcpy/strcat

Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.

Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

1 files changed, 10 insertions, 4 deletions

diff --git a/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp b/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
index 0fe14b0..4866639 100644
--- a/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
+++ b/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
@@ -15,6 +15,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 

 #include "stdio.h"

 #include "stdlib.h"

+#include "assert.h"

 #include "CommonLib.h"

 #include "VfrUtilityLib.h"

 #include "VfrFormPkg.h"

@@ -842,7 +843,9 @@ CVfrVarDataTypeDB::InternalTypesListInit (
   for (Index = 0; gInternalTypesTable[Index].mTypeName != NULL; Index++) {

     New                 = new SVfrDataType;

     if (New != NULL) {

-      strcpy (New->mTypeName, gInternalTypesTable[Index].mTypeName);

+      assert (strlen (gInternalTypesTable[Index].mTypeName) < MAX_NAME_LEN);

+      strncpy (New->mTypeName, gInternalTypesTable[Index].mTypeName, MAX_NAME_LEN - 1);

+      New->mTypeName[MAX_NAME_LEN - 1] = 0;

       New->mType        = gInternalTypesTable[Index].mType;

       New->mAlign       = gInternalTypesTable[Index].mAlign;

       New->mTotalSize   = gInternalTypesTable[Index].mSize;

@@ -1084,7 +1087,8 @@ CVfrVarDataTypeDB::SetNewTypeName (
     }

   }

 

-  strcpy(mNewDataType->mTypeName, TypeName);

+  strncpy(mNewDataType->mTypeName, TypeName, MAX_NAME_LEN - 1);

+  mNewDataType->mTypeName[MAX_NAME_LEN - 1] = 0;

   return VFR_RETURN_SUCCESS;

 }

 

@@ -1145,7 +1149,8 @@ CVfrVarDataTypeDB::DataTypeAddBitField (
 

   MaxDataTypeSize = mNewDataType->mTotalSize;

   if (FieldName != NULL) {

-    strcpy (pNewField->mFieldName, FieldName);

+    strncpy (pNewField->mFieldName, FieldName, MAX_NAME_LEN - 1);

+    pNewField->mFieldName[MAX_NAME_LEN - 1] = 0;

   }

   pNewField->mFieldType    = pFieldType;

   pNewField->mIsBitField   = TRUE;

@@ -1239,7 +1244,8 @@ CVfrVarDataTypeDB::DataTypeAddField (
   if ((pNewField = new SVfrDataField) == NULL) {

     return VFR_RETURN_OUT_FOR_RESOURCES;

   }

-  strcpy (pNewField->mFieldName, FieldName);

+  strncpy (pNewField->mFieldName, FieldName, MAX_NAME_LEN - 1);

+  pNewField->mFieldName[MAX_NAME_LEN - 1] = 0;

   pNewField->mFieldType    = pFieldType;

   pNewField->mArrayNum     = ArrayNum;

   pNewField->mIsBitField   = FALSE;