IntelFrameworkModulePkg GenericBdsLib: Potential read over memory boudary

This commit will resolve the issue brought by r17733.

StringBuffer1 = AllocateCopyPool (
                  MAX_STRING_LEN * sizeof (CHAR16),
                  L"Configuration changed. Reset to apply it Now."
                  );

The above using of AllocateCopyPool() will read contents out of the scope
of the constant string. Potential risk for the constant string allocated
at the boundary of memory region.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Jeff Fan <jeff.fan@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17929 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c
index b5be63140f4f8023dab011a47cab8488c0bc8429..24c1998a1415de2773f20416bc68ef659408da78 100644 (file)
--- a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c
+++ b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsMisc.c
@@ -1127,16 +1127,20 @@ SetupResetReminder (
   if (IsResetReminderFeatureEnable ()) {\r
     if (IsResetRequired ()) {\r
 \r
-      StringBuffer1 = AllocateCopyPool (\r
-                        MAX_STRING_LEN * sizeof (CHAR16),\r
-                        L"Configuration changed. Reset to apply it Now."\r
-                        );\r
+      StringBuffer1 = AllocateZeroPool (MAX_STRING_LEN * sizeof (CHAR16));\r
       ASSERT (StringBuffer1 != NULL);\r
-      StringBuffer2 = AllocateCopyPool (\r
-                        MAX_STRING_LEN * sizeof (CHAR16),\r
-                        L"Press ENTER to reset"\r
-                        );\r
+      StringBuffer2 = AllocateZeroPool (MAX_STRING_LEN * sizeof (CHAR16));\r
       ASSERT (StringBuffer2 != NULL);\r
+      StrCpyS (\r
+        StringBuffer1,\r
+        MAX_STRING_LEN,\r
+        L"Configuration changed. Reset to apply it Now."\r
+        );\r
+      StrCpyS (\r
+        StringBuffer2,\r
+        MAX_STRING_LEN,\r
+        L"Press ENTER to reset"\r
+        );\r
       //\r
       // Popup a menu to notice user\r
       //\r