Date: Thu, 23 Mar 2017 02:30:57 +0000 (UTC) From: Warner Losh <imp@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r315771 - head/lib/libefivar Message-ID: <201703230230.v2N2UvL2047555@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: imp Date: Thu Mar 23 02:30:57 2017 New Revision: 315771 URL: https://svnweb.freebsd.org/changeset/base/315771 Log: Fix a coverity-discovered NULL pointer dereference. *** CID 1372598: Null pointer dereferences (FORWARD_NULL) /lib/libefivar/efivar-dp-parse.c: 3612 in UefiDevicePathLibConvertTextToDeviceNode() Dereferencing null pointer "FromText". When ported from Tiano core, I commented this out with an ifdef. That was in error because we're supposed to fallback to a filepath when nothing else patches. Instead, restore the original code, but fix DevPathFromTextFilePath to cope with the conversion to narrow strings. Also, fix the off-by-one error in the size of the memory it allocates. The off by one error is documented in Tiano core bug https://bugzilla.tianocore.org/show_bug.cgi?id=441 CID: 1372598 Sponsored by: Netflix Modified: head/lib/libefivar/efivar-dp-parse.c (contents, props changed) Modified: head/lib/libefivar/efivar-dp-parse.c ============================================================================== --- head/lib/libefivar/efivar-dp-parse.c Thu Mar 23 02:30:52 2017 (r315770) +++ head/lib/libefivar/efivar-dp-parse.c Thu Mar 23 02:30:57 2017 (r315771) @@ -3006,7 +3006,6 @@ DevPathFromTextVenMedia ( ); } -#ifndef __FreeBSD__ /** Converts a text device path node to File device path structure. @@ -3023,6 +3022,7 @@ DevPathFromTextFilePath ( { FILEPATH_DEVICE_PATH *File; +#ifndef __FreeBSD__ File = (FILEPATH_DEVICE_PATH *) CreateDeviceNode ( MEDIA_DEVICE_PATH, MEDIA_FILEPATH_DP, @@ -3030,10 +3030,26 @@ DevPathFromTextFilePath ( ); StrCpyS (File->PathName, StrLen (TextDeviceNode) + 1, TextDeviceNode); +#else + File = (FILEPATH_DEVICE_PATH *) CreateDeviceNode ( + MEDIA_DEVICE_PATH, + MEDIA_FILEPATH_DP, + (UINT16) (sizeof (FILEPATH_DEVICE_PATH) + StrLen (TextDeviceNode) + 1) + ); + + /* + * Note: We'd have to change the Tianocore header files to fix this + * to not need a cast. Instead we just cast it here. The Interface + * to the user may have issues since this won't be a UCS-2 + * string. Also note that in the original code, a NUL wasn't + * allocated for the end of the string, but we copy that below. This + * has been corrected. + */ + StrCpyS ((char *)File->PathName, StrLen (TextDeviceNode) + 1, TextDeviceNode); +#endif return (EFI_DEVICE_PATH_PROTOCOL *) File; } -#endif /** Converts a text device path node to Media protocol device path structure. @@ -3598,7 +3614,6 @@ UefiDevicePathLibConvertTextToDeviceNode } } -#ifndef __FreeBSD__ if (FromText == NULL) { // // A file path @@ -3606,9 +3621,6 @@ UefiDevicePathLibConvertTextToDeviceNode FromText = DevPathFromTextFilePath; DeviceNode = FromText (DeviceNodeStr); } else { -#else - { -#endif DeviceNode = FromText (ParamStr); FreePool (ParamStr); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703230230.v2N2UvL2047555>