Date: Wed, 3 May 2023 00:29:28 GMT From: John Baldwin <jhb@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 42ed407622aa - stable/13 - libefivar: Fix a buffer overread. Message-ID: <202305030029.3430TSGx071789@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=42ed407622aa53f9794b9d3d378c725945d27623 commit 42ed407622aa53f9794b9d3d378c725945d27623 Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2022-10-03 23:10:44 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2023-05-02 23:46:37 +0000 libefivar: Fix a buffer overread. DevPathToTextUsbWWID allocates a separate copy of the SerialNumber string to append a null terminator if the original string is not null terminated. However, by using AllocateCopyPool, it tries to copy 'Length + 1' words from the existing string containing 'Length' characters into the target string. Split the copy out to only copy 'Length' characters instead. Reviewed by: imp, emaste Reported by: GCC 12 -Wstringop-overread Differential Revision: https://reviews.freebsd.org/D36826 (cherry picked from commit d30a1689f5b37e78ea189232a8b94a7011dc0dc8) --- lib/libefivar/efivar-dp-format.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/libefivar/efivar-dp-format.c b/lib/libefivar/efivar-dp-format.c index 14f6adc2fd98..c6bb0f9dba7d 100644 --- a/lib/libefivar/efivar-dp-format.c +++ b/lib/libefivar/efivar-dp-format.c @@ -1008,9 +1008,10 @@ DevPathToTextUsbWWID ( // // In case no NULL terminator in SerialNumber, create a new one with NULL terminator // - NewStr = AllocateCopyPool ((Length + 1) * sizeof (CHAR16), SerialNumberStr); + NewStr = AllocatePool ((Length + 1) * sizeof (CHAR16)); ASSERT (NewStr != NULL); - NewStr [Length] = 0; + CopyMem (NewStr, SerialNumberStr, Length * sizeof (CHAR16)); + NewStr[Length] = 0; SerialNumberStr = NewStr; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202305030029.3430TSGx071789>