Difuse/u-boot
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

efi_loader: fix device path to text protocol

Browse source 
The printing of a file path node must properly handle:

* odd length of the device path node
* UTF-16 character only partially contained in device path node
* buffer overflow due to very long file path

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
This commit is contained in:
Heinrich Schuchardt 2022-01-29 19:01:07 +01:00
parent c672dd770e
commit 344f26a766
1 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
lib/efi_loader/efi_device_path_to_text.c
View file

@ -8,6 +8,7 @@
#include <common.h> #include <common.h>
#include <blk.h> #include <blk.h>
#include <efi_loader.h> #include <efi_loader.h>
#include <malloc.h>
#define MAC_OUTPUT_LEN 22 #define MAC_OUTPUT_LEN 22
#define UNKNOWN_OUTPUT_LEN 23 #define UNKNOWN_OUTPUT_LEN 23
@ -292,10 +293,18 @@ static char *dp_media(char *s, struct efi_device_path *dp)
case DEVICE_PATH_SUB_TYPE_FILE_PATH: { case DEVICE_PATH_SUB_TYPE_FILE_PATH: {
struct efi_device_path_file_path *fp = struct efi_device_path_file_path *fp =
(struct efi_device_path_file_path *)dp; (struct efi_device_path_file_path *)dp;
int slen = (dp->length - sizeof(*dp)) / 2; u16 *buffer;
if (slen > MAX_NODE_LEN - 2) int slen = dp->length - sizeof(*dp);
slen = MAX_NODE_LEN - 2;
s += sprintf(s, "%-.*ls", slen, fp->str); /* two bytes for \0, extra byte if dp->length is odd */
buffer = calloc(1, slen + 3);
if (!buffer) {
log_err("Out of memory\n");
return s;
}
memcpy(buffer, fp->str, dp->length - sizeof(*dp));
s += snprintf(s, MAX_NODE_LEN - 1, "%ls", buffer);
free(buffer);
break; break;
} }
default: default: