Append the terminating null character at the end of the string to avo…

…id buffer overflow. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qiu Shumin <[email protected]> Reviewed-by: Fu Siyuan <[email protected]> git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15888 6f19259b-4bc3-4df7-8a09-765794883524
bumfany · Aug 25, 2014 · a361d39 · a361d39
1 parent b69fd59
commit a361d39
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 4 deletions.
diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
@@ -60,7 +60,8 @@ PxeBcCheckPacket (
   if (Packet->OpCode == EFI_MTFTP4_OPCODE_ERROR) {
     Private->Mode.TftpErrorReceived = TRUE;
     Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
-    AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, 127);
+    AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);
+    Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
   }
 
   if (Callback != NULL) {
@@ -162,8 +163,9 @@ PxeBcTftpGetFileSize (
       AsciiStrnCpy (
         Private->Mode.TftpError.ErrorString, 
         (CHAR8 *) Packet->Error.ErrorMessage, 
-        127
+        PXE_MTFTP_ERROR_STRING_LENGTH
         );
+      Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
     }
     goto ON_ERROR;
   }

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
@@ -1,7 +1,7 @@
 /** @file
   Mtftp routines for PxeBc.
     
-Copyright (c) 2007 - 2009, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -21,6 +21,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define PXE_MTFTP_OPTION_MULTICAST_INDEX 3
 #define PXE_MTFTP_OPTION_MAXIMUM_INDEX   4
 
+#define PXE_MTFTP_ERROR_STRING_LENGTH    127
+
 
 /**
   This function is to get size of a file by Tftp.

diff --git a/NetworkPkg/Application/IpsecConfig/Indexer.c b/NetworkPkg/Application/IpsecConfig/Indexer.c
@@ -1,7 +1,7 @@
 /** @file
   The implementation of construct ENTRY_INDEXER in IpSecConfig application.
 
-  Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -234,6 +234,7 @@ ConstructPadIndexer (
       }
 
       Indexer->PadId.PeerIdValid = TRUE;
+      ZeroMem (Indexer->PadId.Id.PeerId, MAX_PEERID_LEN);
       StrnCpy ((CHAR16 *) Indexer->PadId.Id.PeerId, ValueStr, ARRAY_SIZE (Indexer->PadId.Id.PeerId) - 1);
     }
   }

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c b/NetworkPkg/UefiPxeBcDxe/PxeBcMtftp.c
@@ -69,6 +69,7 @@ PxeBcMtftp6CheckPacket (
       (CHAR8 *) Packet->Error.ErrorMessage,
       PXE_MTFTP_ERROR_STRING_LENGTH
       );
+    Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
   }
 
   if (Callback != NULL) {
@@ -182,6 +183,7 @@ PxeBcMtftp6GetFileSize (
         (CHAR8 *) Packet->Error.ErrorMessage,
         PXE_MTFTP_ERROR_STRING_LENGTH
         );
+      Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
     }
     goto ON_ERROR;
   }
@@ -511,6 +513,7 @@ PxeBcMtftp4CheckPacket (
       (CHAR8 *) Packet->Error.ErrorMessage,
       PXE_MTFTP_ERROR_STRING_LENGTH
       );
+    Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
   }
 
   if (Callback != NULL) {
@@ -624,6 +627,7 @@ PxeBcMtftp4GetFileSize (
         (CHAR8 *) Packet->Error.ErrorMessage,
         PXE_MTFTP_ERROR_STRING_LENGTH
         );
+      Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
     }
     goto ON_ERROR;
   }