ShellPkg/Hexedit: Fix FreePool() ASSERT() when writing disk

The HDiskImageSave() function copies a device path using
DuplicateDevicePath() and passes that device path to
gBS->LocateDevicePath() that changes the value of the
device path pointer.  When FreePool() is called with the
modified device path pointer, the FreePool() service
generates an ASSERT() because the signature for the pool
head can not be found.

The function HDiskImageRead() immediately above
HDiskImageSave() has the correct algorithm that uses an
additional local variable called DupDevicePathForFree to
preserve the pointer to the allocated buffer so it can
be used in the call to FreePool().

Bug: <https://bugzilla.tianocore.org/show_bug.cgi?id=131>

Cc: Jaben Carsey <jaben.carsey@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Jaben Carsey <Jaben.carsey@intel.com>

diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/DiskImage.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/DiskImage.c
index a50b52f5f207b68d51dc7cbf2a0aeb0683ee0ded..1c93cd8958412fddd6db76dae63cb3c84f3592bb 100644 (file)
--- a/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/DiskImage.c
+++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/DiskImage.c
@@ -1,7 +1,7 @@
 /** @file\r
   Functions to deal with Disk buffer.\r
 \r
 /** @file\r
   Functions to deal with Disk buffer.\r
 \r

-  Copyright (c) 2005 - 2011, Intel Corporation. All rights reserved. <BR>\r
+  Copyright (c) 2005 - 2016, Intel Corporation. All rights reserved. <BR>\r

   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r


@@ -343,6 +343,7 @@ HDiskImageSave (
 \r
   CONST EFI_DEVICE_PATH_PROTOCOL  *DevicePath;\r
   EFI_DEVICE_PATH_PROTOCOL        *DupDevicePath;\r
 \r
   CONST EFI_DEVICE_PATH_PROTOCOL  *DevicePath;\r
   EFI_DEVICE_PATH_PROTOCOL        *DupDevicePath;\r

+  EFI_DEVICE_PATH_PROTOCOL        *DupDevicePathForFree;\r

   EFI_BLOCK_IO_PROTOCOL           *BlkIo;\r
   EFI_STATUS                      Status;\r
   EFI_HANDLE                      Handle;\r
   EFI_BLOCK_IO_PROTOCOL           *BlkIo;\r
   EFI_STATUS                      Status;\r
   EFI_HANDLE                      Handle;\r


@@ -364,12 +365,13 @@ HDiskImageSave (
     return EFI_INVALID_PARAMETER;\r
   }\r
   DupDevicePath = DuplicateDevicePath(DevicePath);\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   DupDevicePath = DuplicateDevicePath(DevicePath);\r

+  DupDevicePathForFree = DupDevicePath;\r

 \r
   //\r
   // get blkio interface\r
   //\r
   Status = gBS->LocateDevicePath(&gEfiBlockIoProtocolGuid,&DupDevicePath,&Handle);\r
 \r
   //\r
   // get blkio interface\r
   //\r
   Status = gBS->LocateDevicePath(&gEfiBlockIoProtocolGuid,&DupDevicePath,&Handle);\r

-  FreePool(DupDevicePath);\r
+  FreePool(DupDevicePathForFree);\r

   if (EFI_ERROR (Status)) {\r
 //    StatusBarSetStatusString (L"Read Disk Failed");\r
     return Status;\r
   if (EFI_ERROR (Status)) {\r
 //    StatusBarSetStatusString (L"Read Disk Failed");\r
     return Status;\r