ShellPkg: Avoid buffer out-of-bound access

PathSize is the number of bytes in PathForReturn buffer so
PathForReturn[PathSize - 1] incorrectly accesses the last
character in the buffer,
PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Steven Shi <steven.shi@intel.com>

diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c
index b3b8acc0d01833c6e09fd4c661bf160ebe895ab2..991fb58ca70e3b6b53e2405b60ed710088b090ec 100644 (file)
--- a/ShellPkg/Application/Shell/ShellProtocol.c
+++ b/ShellPkg/Application/Shell/ShellProtocol.c
@@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath(
         //  UEFI Shell spec section 3.7)\r
         if ((PathSize != 0)                        &&\r
             (PathForReturn != NULL)                &&\r
-            (PathForReturn[PathSize - 1] != L'\\') &&\r
+            (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') &&\r
             (AlignedNode->PathName[0]    != L'\\')) {\r
           PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1);\r
         }\r