From owner-svn-src-head@freebsd.org Thu Mar 23 02:30:58 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B675FD18220; Thu, 23 Mar 2017 02:30:58 +0000 (UTC) (envelope-from imp@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7918F1486; Thu, 23 Mar 2017 02:30:58 +0000 (UTC) (envelope-from imp@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v2N2UvKc047556; Thu, 23 Mar 2017 02:30:57 GMT (envelope-from imp@FreeBSD.org) Received: (from imp@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v2N2UvL2047555; Thu, 23 Mar 2017 02:30:57 GMT (envelope-from imp@FreeBSD.org) Message-Id: <201703230230.v2N2UvL2047555@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: imp set sender to imp@FreeBSD.org using -f From: Warner Losh Date: Thu, 23 Mar 2017 02:30:57 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r315771 - head/lib/libefivar X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 02:30:58 -0000 Author: imp Date: Thu Mar 23 02:30:57 2017 New Revision: 315771 URL: https://svnweb.freebsd.org/changeset/base/315771 Log: Fix a coverity-discovered NULL pointer dereference. *** CID 1372598: Null pointer dereferences (FORWARD_NULL) /lib/libefivar/efivar-dp-parse.c: 3612 in UefiDevicePathLibConvertTextToDeviceNode() Dereferencing null pointer "FromText". When ported from Tiano core, I commented this out with an ifdef. That was in error because we're supposed to fallback to a filepath when nothing else patches. Instead, restore the original code, but fix DevPathFromTextFilePath to cope with the conversion to narrow strings. Also, fix the off-by-one error in the size of the memory it allocates. The off by one error is documented in Tiano core bug https://bugzilla.tianocore.org/show_bug.cgi?id=441 CID: 1372598 Sponsored by: Netflix Modified: head/lib/libefivar/efivar-dp-parse.c (contents, props changed) Modified: head/lib/libefivar/efivar-dp-parse.c ============================================================================== --- head/lib/libefivar/efivar-dp-parse.c Thu Mar 23 02:30:52 2017 (r315770) +++ head/lib/libefivar/efivar-dp-parse.c Thu Mar 23 02:30:57 2017 (r315771) @@ -3006,7 +3006,6 @@ DevPathFromTextVenMedia ( ); } -#ifndef __FreeBSD__ /** Converts a text device path node to File device path structure. @@ -3023,6 +3022,7 @@ DevPathFromTextFilePath ( { FILEPATH_DEVICE_PATH *File; +#ifndef __FreeBSD__ File = (FILEPATH_DEVICE_PATH *) CreateDeviceNode ( MEDIA_DEVICE_PATH, MEDIA_FILEPATH_DP, @@ -3030,10 +3030,26 @@ DevPathFromTextFilePath ( ); StrCpyS (File->PathName, StrLen (TextDeviceNode) + 1, TextDeviceNode); +#else + File = (FILEPATH_DEVICE_PATH *) CreateDeviceNode ( + MEDIA_DEVICE_PATH, + MEDIA_FILEPATH_DP, + (UINT16) (sizeof (FILEPATH_DEVICE_PATH) + StrLen (TextDeviceNode) + 1) + ); + + /* + * Note: We'd have to change the Tianocore header files to fix this + * to not need a cast. Instead we just cast it here. The Interface + * to the user may have issues since this won't be a UCS-2 + * string. Also note that in the original code, a NUL wasn't + * allocated for the end of the string, but we copy that below. This + * has been corrected. + */ + StrCpyS ((char *)File->PathName, StrLen (TextDeviceNode) + 1, TextDeviceNode); +#endif return (EFI_DEVICE_PATH_PROTOCOL *) File; } -#endif /** Converts a text device path node to Media protocol device path structure. @@ -3598,7 +3614,6 @@ UefiDevicePathLibConvertTextToDeviceNode } } -#ifndef __FreeBSD__ if (FromText == NULL) { // // A file path @@ -3606,9 +3621,6 @@ UefiDevicePathLibConvertTextToDeviceNode FromText = DevPathFromTextFilePath; DeviceNode = FromText (DeviceNodeStr); } else { -#else - { -#endif DeviceNode = FromText (ParamStr); FreePool (ParamStr); }