pointer verification (not NULL) and buffer overrun fixes.

[mirror_edk2.git] / ShellPkg / Library / UefiShellDebug1CommandsLib / SetVar.c

diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c
index 324db922e6ae6d5d6ee5b9830df9dba9c5552bac..afccf7bd5821aa0a7740ae73225e5fb87387a1c5 100644 (file)
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c
@@ -154,11 +154,15 @@ ShellCommandRunSetVar (
             // arbitrary buffer\r
             //\r
             Buffer = AllocateZeroPool((StrLen(Data) / 2));\r
-            for (LoopVar = 0 ; LoopVar < (StrLen(Data) / 2) ; LoopVar++) {\r
-              ((UINT8*)Buffer)[LoopVar] = (UINT8)(HexCharToUintn(Data[LoopVar*2]) * 16);\r
-              ((UINT8*)Buffer)[LoopVar] = (UINT8)(((UINT8*)Buffer)[LoopVar] + HexCharToUintn(Data[LoopVar*2+1]));\r
+            if (Buffer == NULL) {\r
+              Status = EFI_OUT_OF_RESOURCES;\r
+            } else {\r
+              for (LoopVar = 0 ; LoopVar < (StrLen(Data) / 2) ; LoopVar++) {\r
+                ((UINT8*)Buffer)[LoopVar] = (UINT8)(HexCharToUintn(Data[LoopVar*2]) * 16);\r
+                ((UINT8*)Buffer)[LoopVar] = (UINT8)(((UINT8*)Buffer)[LoopVar] + HexCharToUintn(Data[LoopVar*2+1]));\r
+              }\r
+              Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, StrLen(Data) / 2, Buffer);\r
             }\r
-            Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, StrLen(Data) / 2, Buffer);\r
             if (EFI_ERROR(Status)) {\r
               ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SETVAR_ERROR_SET), gShellDebug1HiiHandle, &Guid, VariableName, Status);\r
               ShellStatus = SHELL_ACCESS_DENIED;\r
@@ -181,11 +185,13 @@ ShellCommandRunSetVar (
           //\r
           Data++;\r
           Buffer = AllocateZeroPool(StrSize(Data) / 2);\r
-          AsciiSPrint(Buffer, StrSize(Data) / 2, "%s", Data);\r
-          ((CHAR8*)Buffer)[AsciiStrLen(Buffer)-1] = CHAR_NULL;\r
-\r
-          \r
-          Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, AsciiStrSize(Buffer)-sizeof(CHAR8), Buffer);\r
+          if (Buffer == NULL) {\r
+            Status = EFI_OUT_OF_RESOURCES;\r
+          } else {\r
+            AsciiSPrint(Buffer, StrSize(Data) / 2, "%s", Data);\r
+            ((CHAR8*)Buffer)[AsciiStrLen(Buffer)-1] = CHAR_NULL;\r
+            Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, AsciiStrSize(Buffer)-sizeof(CHAR8), Buffer);\r
+          }\r
           if (EFI_ERROR(Status)) {\r
             ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SETVAR_ERROR_SET), gShellDebug1HiiHandle, &Guid, VariableName, Status);\r
             ShellStatus = SHELL_ACCESS_DENIED;\r