Append the terminating null character at the end of the string to avoid buffer overflow.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qiu Shumin <shumin.qiu@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15888 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
index 54de16ca5f87e5a4a93b05bf504eb84c983daac9..aa73132cb59d6237d72ad4872d802322fcc8e192 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
@@ -60,7 +60,8 @@ PxeBcCheckPacket (
   if (Packet->OpCode == EFI_MTFTP4_OPCODE_ERROR) {\r
     Private->Mode.TftpErrorReceived = TRUE;\r
     Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;\r
   if (Packet->OpCode == EFI_MTFTP4_OPCODE_ERROR) {\r
     Private->Mode.TftpErrorReceived = TRUE;\r
     Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;\r

-    AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, 127);\r
+    AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);\r
+    Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';\r

   }\r
 \r
   if (Callback != NULL) {\r
   }\r
 \r
   if (Callback != NULL) {\r


@@ -162,8 +163,9 @@ PxeBcTftpGetFileSize (
       AsciiStrnCpy (\r
         Private->Mode.TftpError.ErrorString, \r
         (CHAR8 *) Packet->Error.ErrorMessage, \r
       AsciiStrnCpy (\r
         Private->Mode.TftpError.ErrorString, \r
         (CHAR8 *) Packet->Error.ErrorMessage, \r

-        127\r
+        PXE_MTFTP_ERROR_STRING_LENGTH\r

         );\r
         );\r

+      Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';\r

     }\r
     goto ON_ERROR;\r
   }\r
     }\r
     goto ON_ERROR;\r
   }\r

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
index 534daa9e1b0b4c8383cf1f99bc9cf79a8737849e..9920aff8b01a1c0cdb74eef03feb1704df29e53d 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
@@ -1,7 +1,7 @@
 /** @file\r
   Mtftp routines for PxeBc.\r
     \r
 /** @file\r
   Mtftp routines for PxeBc.\r
     \r

-Copyright (c) 2007 - 2009, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -21,6 +21,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define PXE_MTFTP_OPTION_MULTICAST_INDEX 3\r
 #define PXE_MTFTP_OPTION_MAXIMUM_INDEX   4\r
 \r
 #define PXE_MTFTP_OPTION_MULTICAST_INDEX 3\r
 #define PXE_MTFTP_OPTION_MAXIMUM_INDEX   4\r
 \r

+#define PXE_MTFTP_ERROR_STRING_LENGTH    127\r
+\r

 \r
 /**\r
   This function is to get size of a file by Tftp.\r
 \r
 /**\r
   This function is to get size of a file by Tftp.\r

diff --git a/NetworkPkg/Application/IpsecConfig/Indexer.c b/NetworkPkg/Application/IpsecConfig/Indexer.c
index 1762bbeb5898911651d20db8196f9affd3a6e678..9e066b1cb54ed1c21e9396fa6f4e1e9a2b3821ba 100644 (file)
--- a/NetworkPkg/Application/IpsecConfig/Indexer.c
+++ b/NetworkPkg/Application/IpsecConfig/Indexer.c
@@ -1,7 +1,7 @@
 /** @file\r
   The implementation of construct ENTRY_INDEXER in IpSecConfig application.\r
 \r
 /** @file\r
   The implementation of construct ENTRY_INDEXER in IpSecConfig application.\r
 \r

-  Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r

 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r


@@ -234,6 +234,7 @@ ConstructPadIndexer (
       }\r
 \r
       Indexer->PadId.PeerIdValid = TRUE;\r
       }\r
 \r
       Indexer->PadId.PeerIdValid = TRUE;\r

+      ZeroMem (Indexer->PadId.Id.PeerId, MAX_PEERID_LEN);\r

       StrnCpy ((CHAR16 *) Indexer->PadId.Id.PeerId, ValueStr, ARRAY_SIZE (Indexer->PadId.Id.PeerId) - 1);\r
     }\r
   }\r
       StrnCpy ((CHAR16 *) Indexer->PadId.Id.PeerId, ValueStr, ARRAY_SIZE (Indexer->PadId.Id.PeerId) - 1);\r
     }\r
   }\r

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c b/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c
index 9a80dc5e38d2417ce107fce8507690b4fb8470c4..09196c7ac6579e473067287412c12f935ffc63fd 100644 (file)
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c
@@ -69,6 +69,7 @@ PxeBcMtftp6CheckPacket (
       (CHAR8 *) Packet->Error.ErrorMessage,\r
       PXE_MTFTP_ERROR_STRING_LENGTH\r
       );\r
       (CHAR8 *) Packet->Error.ErrorMessage,\r
       PXE_MTFTP_ERROR_STRING_LENGTH\r
       );\r

+    Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';\r

   }\r
 \r
   if (Callback != NULL) {\r
   }\r
 \r
   if (Callback != NULL) {\r


@@ -182,6 +183,7 @@ PxeBcMtftp6GetFileSize (
         (CHAR8 *) Packet->Error.ErrorMessage,\r
         PXE_MTFTP_ERROR_STRING_LENGTH\r
         );\r
         (CHAR8 *) Packet->Error.ErrorMessage,\r
         PXE_MTFTP_ERROR_STRING_LENGTH\r
         );\r

+      Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';\r

     }\r
     goto ON_ERROR;\r
   }\r
     }\r
     goto ON_ERROR;\r
   }\r


@@ -511,6 +513,7 @@ PxeBcMtftp4CheckPacket (
       (CHAR8 *) Packet->Error.ErrorMessage,\r
       PXE_MTFTP_ERROR_STRING_LENGTH\r
       );\r
       (CHAR8 *) Packet->Error.ErrorMessage,\r
       PXE_MTFTP_ERROR_STRING_LENGTH\r
       );\r

+    Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';\r

   }\r
 \r
   if (Callback != NULL) {\r
   }\r
 \r
   if (Callback != NULL) {\r


@@ -624,6 +627,7 @@ PxeBcMtftp4GetFileSize (
         (CHAR8 *) Packet->Error.ErrorMessage,\r
         PXE_MTFTP_ERROR_STRING_LENGTH\r
         );\r
         (CHAR8 *) Packet->Error.ErrorMessage,\r
         PXE_MTFTP_ERROR_STRING_LENGTH\r
         );\r

+      Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';\r

     }\r
     goto ON_ERROR;\r
   }\r
     }\r
     goto ON_ERROR;\r
   }\r