BaseTools/GenFv: Add checks for user/file inputs

[mirror_edk2.git] / BaseTools / Source / C / GenFv / GenFv.c

diff --git a/BaseTools/Source/C/GenFv/GenFv.c b/BaseTools/Source/C/GenFv/GenFv.c
index 01ae37acd738fcaa40b04e7c3acf16c3d3ca6eaf..4de24b9f7ec1b610b2158b468d99b8886607f8af 100644 (file)
--- a/BaseTools/Source/C/GenFv/GenFv.c
+++ b/BaseTools/Source/C/GenFv/GenFv.c
@@ -4,7 +4,7 @@
   can be found in the Tiano Firmware Volume Generation Utility \r
   Specification, review draft.\r
 \r
-Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -337,7 +337,12 @@ Returns:
         Error (NULL, 0, 1003, "Invalid option value", "Input Ffsfile can't be null");\r
         return STATUS_ERROR;\r
       }\r
-      strcpy (mFvDataInfo.FvFiles[Index], argv[1]);\r
+      if (strlen (argv[1]) > MAX_LONG_FILE_PATH - 1) {\r
+        Error (NULL, 0, 1003, "Invalid option value", "Input Ffsfile name %s is too long!", argv[1]);\r
+        return STATUS_ERROR;\r
+      }\r
+      strncpy (mFvDataInfo.FvFiles[Index], argv[1], MAX_LONG_FILE_PATH - 1);\r
+      mFvDataInfo.FvFiles[Index][MAX_LONG_FILE_PATH - 1] = 0;\r
       DebugMsg (NULL, 0, 9, "FV component file", "the %uth name is %s", (unsigned) Index + 1, argv[1]);\r
       argc -= 2;\r
       argv += 2;\r