From 0f1946b6626e263c7f764c21cc241cc9faf8a1ae Mon Sep 17 00:00:00 2001 From: Shenglei Zhang Date: Fri, 24 Apr 2020 17:11:07 +0800 Subject: [PATCH] NetworkPkg/IScsiDxe: Enhance the check for array boundary Array 'TargetUrl' of size 255 may use index value(s) 255 and 256. So enhance the boundary check to ensure the index is valid. Cc: Maciej Rabeda Cc: Jiaxin Wu Cc: Siyuan Fu Signed-off-by: Shenglei Zhang Reviewed-by: Siyuan Fu --- NetworkPkg/IScsiDxe/IScsiDhcp.c | 2 +- NetworkPkg/IScsiDxe/IScsiDhcp6.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/NetworkPkg/IScsiDxe/IScsiDhcp.c b/NetworkPkg/IScsiDxe/IScsiDhcp.c index 7ce9bf5750..afa8a86cd4 100644 --- a/NetworkPkg/IScsiDxe/IScsiDhcp.c +++ b/NetworkPkg/IScsiDxe/IScsiDhcp.c @@ -122,7 +122,7 @@ IScsiDhcpExtractRootPath ( // if ((!NET_IS_DIGIT (*(Field->Str))) && (*(Field->Str) != '[')) { ConfigNvData->DnsMode = TRUE; - if (Field->Len > sizeof (ConfigNvData->TargetUrl)) { + if ((Field->Len + 2) > sizeof (ConfigNvData->TargetUrl)) { return EFI_INVALID_PARAMETER; } CopyMem (&ConfigNvData->TargetUrl, Field->Str, Field->Len); diff --git a/NetworkPkg/IScsiDxe/IScsiDhcp6.c b/NetworkPkg/IScsiDxe/IScsiDhcp6.c index 86a872adec..691650b733 100644 --- a/NetworkPkg/IScsiDxe/IScsiDhcp6.c +++ b/NetworkPkg/IScsiDxe/IScsiDhcp6.c @@ -161,7 +161,7 @@ IScsiDhcp6ExtractRootPath ( // Server name is expressed as domain name, just save it. // if (ConfigNvData->DnsMode) { - if (Field->Len > sizeof (ConfigNvData->TargetUrl)) { + if ((Field->Len + 2) > sizeof (ConfigNvData->TargetUrl)) { return EFI_INVALID_PARAMETER; } CopyMem (&ConfigNvData->TargetUrl, Field->Str, Field->Len); -- 2.39.2