Allocate temp buffer to avoid potential change user input string buffer.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18238 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Universal/HiiDatabaseDxe/ConfigKeywordHandler.c b/MdeModulePkg/Universal/HiiDatabaseDxe/ConfigKeywordHandler.c
index 529e90f8a88d411f691eac21f4582bcd064e805b..4cf803c54f6a3ffb3bfecf5cb1528b3938474bbe 100644 (file)
--- a/MdeModulePkg/Universal/HiiDatabaseDxe/ConfigKeywordHandler.c
+++ b/MdeModulePkg/Universal/HiiDatabaseDxe/ConfigKeywordHandler.c
@@ -2808,7 +2808,7 @@ EfiConfigKeywordHandlerSetData (
   EFI_STATUS                          Status;\r
   CHAR16                              *StringPtr;\r
   EFI_DEVICE_PATH_PROTOCOL            *DevicePath;\r
-  CHAR16                              *NextStringPtr;  \r
+  CHAR16                              *NextStringPtr;\r
   CHAR16                              *KeywordData;\r
   EFI_STRING_ID                       KeywordStringId;\r
   UINT32                              RetVal;\r
@@ -2819,6 +2819,7 @@ EfiConfigKeywordHandlerSetData (
   CHAR16                              *ValueElement;\r
   BOOLEAN                             ReadOnly;\r
   EFI_STRING                          InternalProgress;\r
+  CHAR16                              *TempString;\r
 \r
   if (This == NULL || Progress == NULL || ProgressErr == NULL || KeywordString == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
@@ -2827,7 +2828,6 @@ EfiConfigKeywordHandlerSetData (
   *Progress    = KeywordString;\r
   *ProgressErr = KEYWORD_HANDLER_UNDEFINED_PROCESSING_ERROR;\r
   Status       = EFI_SUCCESS;\r
-  StringPtr    = KeywordString;\r
   MultiConfigResp = NULL;\r
   NameSpace       = NULL;\r
   DevicePath      = NULL;\r
@@ -2836,6 +2836,13 @@ EfiConfigKeywordHandlerSetData (
   ConfigResp      = NULL;\r
   KeywordStringId = 0;\r
 \r
+  //\r
+  // Use temp string to avoid changing input string buffer.\r
+  //\r
+  TempString = AllocateCopyPool (StrSize (KeywordString), KeywordString);\r
+  ASSERT (TempString != NULL);\r
+  StringPtr = TempString;\r
+\r
   while ((StringPtr != NULL) && (*StringPtr != L'\0')) {\r
     //\r
     // 1. Get NameSpace from NameSpaceId keyword.\r
@@ -2962,6 +2969,8 @@ EfiConfigKeywordHandlerSetData (
   *ProgressErr = KEYWORD_HANDLER_NO_ERROR;\r
 \r
 Done:\r
+  ASSERT (TempString != NULL);\r
+  FreePool (TempString);\r
   if (NameSpace != NULL) {\r
     FreePool (NameSpace);\r
   }\r
@@ -3078,6 +3087,7 @@ EfiConfigKeywordHandlerGetData (
   BOOLEAN                             ReadOnly;\r
   CHAR16                              *KeywordResp;\r
   CHAR16                              *MultiKeywordResp;\r
+  CHAR16                              *TempString;\r
 \r
   if (This == NULL || Progress == NULL || ProgressErr == NULL || Results == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
@@ -3093,18 +3103,35 @@ EfiConfigKeywordHandlerGetData (
   ReadOnly     = FALSE;\r
   MultiKeywordResp = NULL;\r
   KeywordStringId  = 0;\r
+  TempString   = NULL;\r
 \r
+  //\r
+  // Use temp string to avoid changing input string buffer.\r
+  //\r
+  if (NameSpaceId != NULL) {\r
+    TempString = AllocateCopyPool (StrSize (NameSpaceId), NameSpaceId);\r
+    ASSERT (TempString != NULL);\r
+  }\r
   //\r
   // 1. Get NameSpace from NameSpaceId keyword.\r
   //\r
-  Status = ExtractNameSpace (NameSpaceId, &NameSpace, NULL);\r
+  Status = ExtractNameSpace (TempString, &NameSpace, NULL);\r
+  if (TempString != NULL) {\r
+    FreePool (TempString);\r
+    TempString = NULL;\r
+  }\r
   if (EFI_ERROR (Status)) {\r
     *ProgressErr = KEYWORD_HANDLER_NAMESPACE_ID_NOT_FOUND;\r
     return Status;\r
   }\r
 \r
   if (KeywordString != NULL) {\r
-    StringPtr = KeywordString;\r
+    //\r
+    // Use temp string to avoid changing input string buffer.\r
+    //\r
+    TempString = AllocateCopyPool (StrSize (KeywordString), KeywordString);\r
+    ASSERT (TempString != NULL);\r
+    StringPtr = TempString;\r
 \r
     while (*StringPtr != L'\0') {\r
       //\r
@@ -3225,6 +3252,9 @@ EfiConfigKeywordHandlerGetData (
   *ProgressErr = KEYWORD_HANDLER_NO_ERROR;\r
 \r
 Done:\r
+  if (TempString != NULL) {\r
+    FreePool (TempString);\r
+  }\r
   if (NameSpace != NULL) {\r
     FreePool (NameSpace);\r
   }\r