MdePkg: ensure SafeString length functions don't access beyond MaxSize

The StrnLenS and AsciiStrnLenS functions, when presented with a string
with no terminating NULL in the first MaxSize characters will check
the character at String[MaxSize] before checking if Length < MaxSize.
(They return the correct value, but have accessed beyond the stated
limit in the process.)

Flip the order of the tests to prevent this behaviour.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17936 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdePkg/Library/BaseLib/SafeString.c b/MdePkg/Library/BaseLib/SafeString.c
index 7c1b0758f3e0fbb5fb8114cb0ee36002679c9e49..b0e1ce72e2986349f85e1ea8cb7af2cb7d6e9d6a 100644 (file)
--- a/MdePkg/Library/BaseLib/SafeString.c
+++ b/MdePkg/Library/BaseLib/SafeString.c
@@ -141,7 +141,7 @@ StrnLenS (
   // String then StrnLenS returns MaxSize. At most the first MaxSize characters of String shall\r
   // be accessed by StrnLenS.\r
   //\r
-  for (Length = 0; (*String != 0) && (Length < MaxSize); String++, Length++) {\r
+  for (Length = 0; (Length < MaxSize) && (*String != 0); String++, Length++) {\r
     ;\r
   }\r
   return Length;\r
@@ -551,7 +551,7 @@ AsciiStrnLenS (
   // String then AsciiStrnLenS returns MaxSize. At most the first MaxSize characters of String shall\r
   // be accessed by AsciiStrnLenS.\r
   //\r
-  for (Length = 0; (*String != 0) && (Length < MaxSize); String++, Length++) {\r
+  for (Length = 0; (Length < MaxSize) && (*String != 0); String++, Length++) {\r
     ;\r
   }\r
   return Length;\r