From 4f0465058b6ff9c53591ec81951f494a70bde7c1 Mon Sep 17 00:00:00 2001 From: Ruiyu Ni Date: Wed, 26 Jul 2017 16:21:54 +0800 Subject: [PATCH] ShellPkg: Avoid buffer out-of-bound access PathSize is the number of bytes in PathForReturn buffer so PathForReturn[PathSize - 1] incorrectly accesses the last character in the buffer, PathForReturn[PathSize / sizeof (CHAR16) - 1] should be used. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ruiyu Ni Reviewed-by: Steven Shi --- ShellPkg/Application/Shell/ShellProtocol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ShellPkg/Application/Shell/ShellProtocol.c b/ShellPkg/Application/Shell/ShellProtocol.c index b3b8acc0d0..991fb58ca7 100644 --- a/ShellPkg/Application/Shell/ShellProtocol.c +++ b/ShellPkg/Application/Shell/ShellProtocol.c @@ -477,7 +477,7 @@ EfiShellGetFilePathFromDevicePath( // UEFI Shell spec section 3.7) if ((PathSize != 0) && (PathForReturn != NULL) && - (PathForReturn[PathSize - 1] != L'\\') && + (PathForReturn[PathSize / sizeof (CHAR16) - 1] != L'\\') && (AlignedNode->PathName[0] != L'\\')) { PathForReturn = StrnCatGrow (&PathForReturn, &PathSize, L"\\", 1); } -- 2.39.2