BaseTools/VfrCompile: Add/refine boundary checks for strcpy/strcat

Add checks to ensure when the destination string buffer is of fixed
size, the strcpy/strcat functions calls will not access beyond the
boundary.

Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

diff --git a/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp b/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
index 0fe14b0d29215213c48ee38b27e9a0c3efa40130..4866639aabe38573253293078406f046c8e481bc 100644 (file)
--- a/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
+++ b/BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp
@@ -15,6 +15,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 #include "stdio.h"\r
 #include "stdlib.h"\r
+#include "assert.h"\r
 #include "CommonLib.h"\r
 #include "VfrUtilityLib.h"\r
 #include "VfrFormPkg.h"\r
@@ -842,7 +843,9 @@ CVfrVarDataTypeDB::InternalTypesListInit (
   for (Index = 0; gInternalTypesTable[Index].mTypeName != NULL; Index++) {\r
     New                 = new SVfrDataType;\r
     if (New != NULL) {\r
-      strcpy (New->mTypeName, gInternalTypesTable[Index].mTypeName);\r
+      assert (strlen (gInternalTypesTable[Index].mTypeName) < MAX_NAME_LEN);\r
+      strncpy (New->mTypeName, gInternalTypesTable[Index].mTypeName, MAX_NAME_LEN - 1);\r
+      New->mTypeName[MAX_NAME_LEN - 1] = 0;\r
       New->mType        = gInternalTypesTable[Index].mType;\r
       New->mAlign       = gInternalTypesTable[Index].mAlign;\r
       New->mTotalSize   = gInternalTypesTable[Index].mSize;\r
@@ -1084,7 +1087,8 @@ CVfrVarDataTypeDB::SetNewTypeName (
     }\r
   }\r
 \r
-  strcpy(mNewDataType->mTypeName, TypeName);\r
+  strncpy(mNewDataType->mTypeName, TypeName, MAX_NAME_LEN - 1);\r
+  mNewDataType->mTypeName[MAX_NAME_LEN - 1] = 0;\r
   return VFR_RETURN_SUCCESS;\r
 }\r
 \r
@@ -1145,7 +1149,8 @@ CVfrVarDataTypeDB::DataTypeAddBitField (
 \r
   MaxDataTypeSize = mNewDataType->mTotalSize;\r
   if (FieldName != NULL) {\r
-    strcpy (pNewField->mFieldName, FieldName);\r
+    strncpy (pNewField->mFieldName, FieldName, MAX_NAME_LEN - 1);\r
+    pNewField->mFieldName[MAX_NAME_LEN - 1] = 0;\r
   }\r
   pNewField->mFieldType    = pFieldType;\r
   pNewField->mIsBitField   = TRUE;\r
@@ -1239,7 +1244,8 @@ CVfrVarDataTypeDB::DataTypeAddField (
   if ((pNewField = new SVfrDataField) == NULL) {\r
     return VFR_RETURN_OUT_FOR_RESOURCES;\r
   }\r
-  strcpy (pNewField->mFieldName, FieldName);\r
+  strncpy (pNewField->mFieldName, FieldName, MAX_NAME_LEN - 1);\r
+  pNewField->mFieldName[MAX_NAME_LEN - 1] = 0;\r
   pNewField->mFieldType    = pFieldType;\r
   pNewField->mArrayNum     = ArrayNum;\r
   pNewField->mIsBitField   = FALSE;\r