BaseTools/GenBootSector: Add/refine boundary checks for strcpy/strcat

Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.

Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

diff --git a/BaseTools/Source/C/GenBootSector/GenBootSector.c b/BaseTools/Source/C/GenBootSector/GenBootSector.c
index 3908c589afa529ef95fd1b1b4bec2b5e9d51c8a1..c02de49ba2ad6e3e67e59f68853e8655cf572e68 100644 (file)
--- a/BaseTools/Source/C/GenBootSector/GenBootSector.c
+++ b/BaseTools/Source/C/GenBootSector/GenBootSector.c
@@ -4,7 +4,7 @@ Reading/writing MBR/DBR.
     If we write MBR to disk, we just update the MBR code and the partition table wouldn't be over written.\r
     If we process DBR, we will patch MBR to set first partition active if no active partition exists.\r
     \r
     If we write MBR to disk, we just update the MBR code and the partition table wouldn't be over written.\r
     If we process DBR, we will patch MBR to set first partition active if no active partition exists.\r
     \r

-Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r


@@ -631,6 +631,14 @@ GetPathInfo (
        return ErrorSuccess;\r
   } \r
 \r
        return ErrorSuccess;\r
   } \r
 \r

+  //\r
+  // Check the path length\r
+  //\r
+  if (strlen (PathInfo->Path) >= (sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]))) {\r
+    fprintf (stderr, "ERROR, Path is too long for - %s", PathInfo->Path);\r
+    return ErrorPath;\r
+  }\r
+\r

   PathInfo->Type = PathFile;\r
   if (PathInfo->Input) {\r
     //\r
   PathInfo->Type = PathFile;\r
   if (PathInfo->Input) {\r
     //\r


@@ -644,7 +652,12 @@ GetPathInfo (
     fclose (f);\r
   }\r
   PathInfo->Type = PathFile;\r
     fclose (f);\r
   }\r
   PathInfo->Type = PathFile;\r

-  strcpy(PathInfo->PhysicalPath, PathInfo->Path);\r
+  strncpy(\r
+    PathInfo->PhysicalPath,\r
+    PathInfo->Path,\r
+    sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]) - 1\r
+    );\r
+  PathInfo->PhysicalPath[sizeof (PathInfo->PhysicalPath) / sizeof (PathInfo->PhysicalPath[0]) - 1] = 0;\r

 \r
   return ErrorSuccess;\r
 }    \r
 \r
   return ErrorSuccess;\r
 }    \r