From: Ruiyu Ni <ruiyu.ni@intel.com>
Date: Wed, 26 Jul 2017 08:21:54 +0000 (+0800)
Subject: ShellPkg: Avoid buffer out-of-bound access
X-Git-Tag: edk2-stable201903~3758
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=4f0465058b6ff9c53591ec81951f494a70bde7c1

ShellPkg: Avoid buffer out-of-bound access

PathSize is the number of bytes in PathForReturn buffer so
PathForReturn[PathSize - 1] incorrectly accesses the last
character in the buffer,
PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Steven Shi <steven.shi@intel.com>
---

diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c
index b3b8acc0d0..991fb58ca7 100644
--- a/ShellPkg/Application/Shell/ShellProtocol.c
+++ b/ShellPkg/Application/Shell/ShellProtocol.c
@@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath(
         //  UEFI Shell spec section 3.7)
         if ((PathSize != 0)                        &&
             (PathForReturn != NULL)                &&
-            (PathForReturn[PathSize - 1] != L'\\') &&
+            (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') &&
             (AlignedNode->PathName[0]    != L'\\')) {
           PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1);
         }