MdePkg UefiDevicePathLib: Fix possible memory read/write cross boundary

The SSID field of a Wi-Fi device path node may not contain a NULL
termination.

Additonal handle is added to make sure no cross-boundary memory read/write
will occur.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18355 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c
index 9c5436d337632541712bb426ecc0125a4469b0d7..6a9b389ca5c5392b3d621170632f5ff760b99d09 100644 (file)
--- a/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c
+++ b/MdePkg/Library/UefiDevicePathLib/DevicePathFromText.c
@@ -2827,7 +2827,8 @@ DevPathFromTextWiFi (
   )\r
 {\r
   CHAR16                *SSIdStr;\r
-  CHAR8                 *AsciiStr;\r
+  CHAR8                 AsciiStr[33];\r
+  UINTN                 DataLen;\r
   WIFI_DEVICE_PATH      *WiFiDp;\r
 \r
   SSIdStr = GetNextParamStr (&TextDeviceNode);\r
@@ -2837,8 +2838,16 @@ DevPathFromTextWiFi (
                                    (UINT16) sizeof (WIFI_DEVICE_PATH)\r
                                    );\r
 \r
-  AsciiStr = (CHAR8 *) WiFiDp->SSId;\r
-  StrToAscii (SSIdStr, &AsciiStr);\r
+  if (NULL != SSIdStr) {\r
+    DataLen = StrLen (SSIdStr);\r
+    if (StrLen (SSIdStr) > 32) {\r
+      SSIdStr[32] = L'\0';\r
+      DataLen     = 32;\r
+    }\r
+\r
+    UnicodeStrToAsciiStr (SSIdStr, AsciiStr);\r
+    CopyMem (WiFiDp->SSId, AsciiStr, DataLen);\r
+  }\r
 \r
   return (EFI_DEVICE_PATH_PROTOCOL *) WiFiDp;\r
 }\r

diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c
index 0774fd8c17a4b24d3c3ce1d7099d2250058925c0..363830bd32caf96e76ab1df9e090008fc50a4b82 100644 (file)
--- a/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c
+++ b/MdePkg/Library/UefiDevicePathLib/DevicePathToText.c
@@ -1616,9 +1616,14 @@ DevPathToTextWiFi (
   )\r
 {\r
   WIFI_DEVICE_PATH      *WiFi;\r
+  UINT8                 SSId[33];\r
 \r
   WiFi = DevPath;\r
-  UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", WiFi->SSId);\r
+\r
+  SSId[32] = '\0';\r
+  CopyMem (SSId, WiFi->SSId, 32);\r
+\r
+  UefiDevicePathLibCatPrint (Str, L"Wi-Fi(%a)", SSId);\r
 }\r
 \r
 /**\r