Use StrnCat instead of StrCat to avoid target buffer overflow.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jeff Fan <jeff.fan@intel.com>
Reviewed-by: Eric Dong <Eric.Dong@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15797 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/DeviceMngr/DeviceManager.c b/IntelFrameworkModulePkg/Universal/BdsDxe/DeviceMngr/DeviceManager.c
index 6a76c33f267dda4359897c8f1a5a3c4439d9db86..866df574f6e7c7550a55478d82b9004948e855d6 100644 (file)
--- a/IntelFrameworkModulePkg/Universal/BdsDxe/DeviceMngr/DeviceManager.c
+++ b/IntelFrameworkModulePkg/Universal/BdsDxe/DeviceMngr/DeviceManager.c
@@ -1,7 +1,7 @@
 /** @file\r
   The platform device manager reference implementation\r
 \r
-Copyright (c) 2004 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -1260,6 +1260,7 @@ CallDriverHealth (
   LIST_ENTRY                  *Link;\r
   EFI_DEVICE_PATH_PROTOCOL    *DriverDevicePath;\r
   BOOLEAN                     RebootRequired;\r
+  UINTN                       StringSize;\r
 \r
   Index               = 0;\r
   DriverHealthInfo    = NULL;  \r
@@ -1341,7 +1342,8 @@ CallDriverHealth (
     //\r
     // Assume no line strings is longer than 512 bytes.\r
     //\r
-    String = (EFI_STRING) AllocateZeroPool (0x200);\r
+    StringSize = 0x200;\r
+    String = (EFI_STRING) AllocateZeroPool (StringSize);\r
     ASSERT (String != NULL);\r
 \r
     Status = DriverHealthGetDriverName (DriverHealthInfo->DriverHandle, &DriverName);\r
@@ -1410,7 +1412,7 @@ CallDriverHealth (
     }\r
 \r
     ASSERT (TmpString != NULL);\r
-    StrCat (String, TmpString);\r
+    StrnCat (String, TmpString, StringSize / sizeof (CHAR16) - StrLen (String) - 1);\r
     FreePool (TmpString);\r
 \r
     Token = HiiSetString (HiiHandle, 0, String, NULL);\r

diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/MemoryTest.c b/IntelFrameworkModulePkg/Universal/BdsDxe/MemoryTest.c
index 410d4f1db66d75f3b3c54a42abc8c5362f6c3c40..5a6fa78553280b50ad621273c852915de379b46c 100644 (file)
--- a/IntelFrameworkModulePkg/Universal/BdsDxe/MemoryTest.c
+++ b/IntelFrameworkModulePkg/Universal/BdsDxe/MemoryTest.c
@@ -1,7 +1,7 @@
 /** @file\r
   Perform the platform memory test\r
 \r
-Copyright (c) 2004 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -230,11 +230,13 @@ BdsMemoryTest (
   EFI_GRAPHICS_OUTPUT_BLT_PIXEL     Color;\r
   BOOLEAN                           IsFirstBoot;\r
   UINT32                            TempData;\r
+  UINTN                             StrTotalMemorySize;\r
 \r
   ReturnStatus = EFI_SUCCESS;\r
   ZeroMem (&Key, sizeof (EFI_INPUT_KEY));\r
 \r
-  Pos = AllocatePool (128);\r
+  StrTotalMemorySize = 128;\r
+  Pos = AllocateZeroPool (StrTotalMemorySize);\r
 \r
   if (Pos == NULL) {\r
     return ReturnStatus;\r
@@ -322,7 +324,7 @@ BdsMemoryTest (
           //\r
           // TmpStr size is 64, StrPercent is reserved to 16.\r
           //\r
-          StrCat (StrPercent, TmpStr);\r
+          StrnCat (StrPercent, TmpStr, sizeof (StrPercent) / sizeof (CHAR16) - StrLen (StrPercent) - 1);\r
           PrintXY (10, 10, NULL, NULL, StrPercent);\r
           FreePool (TmpStr);\r
         }\r
@@ -382,11 +384,12 @@ Done:
     UnicodeValueToString (StrTotalMemory, COMMA_TYPE, TotalMemorySize, 0);\r
     if (StrTotalMemory[0] == L',') {\r
       StrTotalMemory++;\r
+      StrTotalMemorySize -= sizeof (CHAR16);\r
     }\r
 \r
     TmpStr = GetStringById (STRING_TOKEN (STR_MEM_TEST_COMPLETED));\r
     if (TmpStr != NULL) {\r
-      StrCat (StrTotalMemory, TmpStr);\r
+      StrnCat (StrTotalMemory, TmpStr, StrTotalMemorySize / sizeof (CHAR16) - StrLen (StrTotalMemory) - 1);\r
       FreePool (TmpStr);\r
     }\r
 \r