[edk2] [patch 1/2] MdeModulePkg: Replace unsafe string functions.

[Zhang Lubo]

Replace unsafe string functions with new added safe string functions.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <***@intel.com>
---
MdeModulePkg/Library/DxeNetLib/DxeNetLib.c | 4 ++--
MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c | 2 +-
MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c | 2 +-
.../Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c | 2 +-
MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c | 2 +-
.../Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c | 4 ++--
.../Universal/Network/Mtftp4Dxe/Mtftp4Support.c | 13 ++++++++-----
.../Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c | 17 +++++++++--------
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.c | 12 +++++++-----
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.h | 11 +++++++----
.../Universal/Network/VlanConfigDxe/VlanConfigImpl.c | 12 ++++++------
11 files changed, 45 insertions(+), 36 deletions(-)

diff --git a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
index 467b822..81746d5 100644
--- a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
+++ b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
@@ -2625,11 +2625,11 @@ NetLibDefaultAddressIsStatic (
Len = StrLen (ConfigHdr);
ConfigResp = AllocateZeroPool ((Len + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
if (ConfigResp == NULL) {
goto ON_EXIT;
}
- StrCpy (ConfigResp, ConfigHdr);
+ StrCpyS (ConfigResp, (Len + NIC_ITEM_CONFIG_SIZE * 2 + 100), ConfigHdr);

String = ConfigResp + Len;
UnicodeSPrint (
String,
(8 + 4 + 7 + 4 + 1) * sizeof (CHAR16),
@@ -3385,11 +3385,11 @@ NetLibIp6ToStr (

if ((UINTN)Ptr - (UINTN)Buffer > StringSize) {
return EFI_BUFFER_TOO_SMALL;
}

- StrCpy (String, Buffer);
+ StrCpyS (String, StringSize, Buffer);

return EFI_SUCCESS;
}

/**
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
index e263f0e..75fe12f 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
@@ -776,11 +776,11 @@ IScsiFormCallback (
IScsiUnicodeStrToAsciiStr (IfrNvData->TargetName, IScsiName);
Status = IScsiNormalizeName (IScsiName, AsciiStrLen (IScsiName));
if (EFI_ERROR (Status)) {
CreatePopUp (EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE, &Key, L"Invalid iSCSI Name!", NULL);
} else {
- AsciiStrCpy (Private->Current->SessionConfigData.TargetName, IScsiName);
+ AsciiStrCpyS (Private->Current->SessionConfigData.TargetName, ISCSI_NAME_MAX_SIZE, IScsiName);
}

break;

case KEY_DHCP_ENABLE:
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
index 79e7093..10ef629 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
@@ -156,11 +156,11 @@ IScsiDhcpExtractRootPath (
Status = IScsiNormalizeName (Field->Str, AsciiStrLen (Field->Str));
if (EFI_ERROR (Status)) {
goto ON_EXIT;
}

- AsciiStrCpy (ConfigNvData->TargetName, Field->Str);
+ AsciiStrCpyS (ConfigNvData->TargetName, ISCSI_NAME_MAX_SIZE, Field->Str);

ON_EXIT:

FreePool (TmpStr);

diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
index da14105..e3576c1 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
@@ -242,11 +242,11 @@ IScsiExtScsiPassThruBuildDevicePath (
break;
}

CopyMem (&Node->Iscsi.Lun, ConfigNvData->BootLun, sizeof (UINT64));
Node->Iscsi.TargetPortalGroupTag = Session->TargetPortalGroupTag;
- AsciiStrCpy ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), ConfigNvData->TargetName);
+ AsciiStrCpyS ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), AsciiStrLen (ConfigNvData->TargetName) + 1, ConfigNvData->TargetName);

*DevicePath = (EFI_DEVICE_PATH_PROTOCOL *) Node;

return EFI_SUCCESS;
}
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
index 1cb1fb8..85a23a2 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
@@ -202,11 +202,11 @@ IScsiLunToUnicodeStr (
TempStr = Str;

for (Index = 0; Index < 4; Index++) {

if ((Lun[2 * Index] | Lun[2 * Index + 1]) == 0) {
- StrCpy (TempStr, L"0-");
+ CopyMem(TempStr, L"0-", StrSize(L"0-"));
} else {
TempStr[0] = (CHAR16) IScsiHexString[Lun[2 * Index] >> 4];
TempStr[1] = (CHAR16) IScsiHexString[Lun[2 * Index] & 0x0F];
TempStr[2] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] >> 4];
TempStr[3] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] & 0x0F];
diff --git a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
index 89e1dda..7be3e87 100644
--- a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
+++ b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
@@ -485,14 +485,14 @@ Ip4DeviceExtractConfig (
Size = Size + 1;
Size = Size + StrLen (FormResult) + 1;
*Results = AllocateZeroPool (Size * sizeof (CHAR16));
ASSERT (*Results != NULL);
StrPointer = *Results;
- StrCpy (StrPointer, DeviceResult);
+ StrCpyS (StrPointer, Size, DeviceResult);
StrPointer = StrPointer + StrLen (StrPointer);
*StrPointer = L'&';
- StrCpy (StrPointer + 1, FormResult);
+ StrCpyS (StrPointer + 1, StrLen (FormResult) + 1, FormResult);
FreePool (DeviceResult);
FreePool (FormResult);
} else if (HiiIsConfigHdrMatch (Request, &gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
*Results = DeviceResult;
} else if (HiiIsConfigHdrMatch (Request, &gNicIp4ConfigNvDataGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
diff --git a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
index df79c85..85bdf5a 100644
--- a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
+++ b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
@@ -317,21 +317,24 @@ Mtftp4SendRequest (
Packet = (EFI_MTFTP4_PACKET *) NetbufAllocSpace (Nbuf, Len, FALSE);
ASSERT (Packet != NULL);

Packet->OpCode = HTONS (Instance->Operation);
Cur = Packet->Rrq.Filename;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Token->Filename);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - 2, (CHAR8 *) Token->Filename);
Cur += AsciiStrLen ((CHAR8 *) Token->Filename) + 1;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Mode);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - (AsciiStrLen ((CHAR8 *) Token->Filename) + 1), (CHAR8 *) Mode);
Cur += AsciiStrLen ((CHAR8 *) Mode) + 1;
+ Len -= ((UINT32) AsciiStrLen ((CHAR8 *) Token->Filename) + (UINT32) AsciiStrLen ((CHAR8 *) Mode) + 4);

for (Index = 0; Index < Token->OptionCount; ++Index) {
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].OptionStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].OptionStr);
Cur += AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1);

- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].ValueStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].ValueStr);
Cur += AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1);
}

return Mtftp4SendPacket (Instance, Nbuf);
}

@@ -369,11 +372,11 @@ Mtftp4SendError (
ASSERT (TftpError != NULL);

TftpError->OpCode = HTONS (EFI_MTFTP4_OPCODE_ERROR);
TftpError->Error.ErrorCode = HTONS (ErrCode);

- AsciiStrCpy ((CHAR8 *) TftpError->Error.ErrorMessage, (CHAR8 *) ErrInfo);
+ AsciiStrCpyS ((CHAR8 *) TftpError->Error.ErrorMessage, Len, (CHAR8 *) ErrInfo);

return Mtftp4SendPacket (Instance, Packet);
}


diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
index aa73132..20747ed 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
@@ -58,11 +58,11 @@ PxeBcCheckPacket (
Status = EFI_SUCCESS;

if (Packet->OpCode == EFI_MTFTP4_OPCODE_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);
+ AsciiStrnCpyS (Private->Mode.TftpError.ErrorString, PXE_MTFTP_ERROR_STRING_LENGTH, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}

if (Callback != NULL) {

@@ -133,17 +133,17 @@ PxeBcTftpGetFileSize (

return Status;
}

ReqOpt[0].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_TSIZE_INDEX];
- UtoA10 (0, (CHAR8 *) OptBuf);
+ UtoA10 (0, (CHAR8 *) OptBuf, 128);
ReqOpt[0].ValueStr = OptBuf;

if (BlockSize != NULL) {
ReqOpt[1].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[1].ValueStr = ReqOpt[0].ValueStr + AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr, 128 - (AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1));
OptCnt++;
}

Status = Mtftp4->GetInfo (
Mtftp4,
@@ -158,12 +158,13 @@ PxeBcTftpGetFileSize (

if (EFI_ERROR (Status)) {
if (Status == EFI_TFTP_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (
- Private->Mode.TftpError.ErrorString,
+ AsciiStrnCpyS (
+ Private->Mode.TftpError.ErrorString,
+ PXE_MTFTP_ERROR_STRING_LENGTH,
(CHAR8 *) Packet->Error.ErrorMessage,
PXE_MTFTP_ERROR_STRING_LENGTH
);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}
@@ -259,11 +260,11 @@ PxeBcTftpReadFile (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
@@ -342,11 +343,11 @@ PxeBcTftpWriteFile (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
@@ -416,11 +417,11 @@ PxeBcTftpReadDirectory (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
index 327e4a2..51d1a5a 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
@@ -138,20 +138,22 @@ CvtNum (


/**
Convert unsigned int number to decimal number.

- @param Number The unsigned int number will be converted.
- @param Buffer Pointer to the buffer to store the decimal number after transform.
-
+ @param Number The unsigned int number will be converted.
+ @param Buffer Pointer to the buffer to store the decimal number after transform.
+ @param[in] BufferSize The maxsize of the buffer.
+
@return the length of the number after transform.

**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
)
{
UINTN Index;
CHAR8 TempStr[64];

@@ -162,11 +164,11 @@ UtoA10 (
Index--;
TempStr[Index] = (CHAR8) ('0' + (Number % 10));
Number = Number / 10;
} while (Number != 0);

- AsciiStrCpy (Buffer, &TempStr[Index]);
+ AsciiStrCpyS (Buffer, BufferSize, &TempStr[Index]);

return AsciiStrLen (Buffer);
}


diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
index 96f48f5..89a6afa 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
@@ -80,20 +80,23 @@ CvtNum (


/**
Convert unsigned int number to decimal number.

- @param Number The unsigned int number will be converted.
- @param Buffer Pointer to the buffer to store the decimal number after transform.
-
+ @param Number The unsigned int number will be converted.
+ @param Buffer Pointer to the buffer to store the decimal number after transform.
+ @param[in] BufferSize The maxsize of the buffer.
+
@return the length of the number after transform.

**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
+
);


/**
Convert ASCII numeric string to a UINTN value.
diff --git a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
index fd8555e..baa3eb3 100644
--- a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
+++ b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
@@ -410,21 +410,21 @@ VlanUpdateForm (

ZeroMem (PrivateData->VlanId, MAX_VLAN_NUMBER);
for (Index = 0; Index < NumberOfVlan; Index++) {
String = VlanStr;

- StrCpy (String, L" VLAN ID:");
+ StrCpyS (String, 30, L" VLAN ID:");
String += 10;
//
// Pad VlanId string up to 4 characters with space
//
DigitalCount = UnicodeValueToString (VlanIdStr, 0, VlanData[Index].VlanId, 5);
SetMem16 (String, (4 - DigitalCount) * sizeof (CHAR16), L' ');
- StrCpy (String + 4 - DigitalCount, VlanIdStr);
+ StrCpyS (String + 4 - DigitalCount, 30 - 10 - (4 - DigitalCount), VlanIdStr);
String += 4;

- StrCpy (String, L", Priority:");
+ StrCpyS (String, 30 - 10 - (4 - DigitalCount) - 4, L", Priority:");
String += 11;
String += UnicodeValueToString (String, 0, VlanData[Index].Priority, 4);
*String = 0;

StringId = HiiSetString (PrivateData->HiiHandle, 0, VlanStr, NULL);
@@ -557,13 +557,13 @@ InstallVlanConfigForm (
if (EFI_ERROR (Status)) {
return Status;
}
PrivateData->MacString = MacString;

- StrCpy (Str, L"VLAN Configuration (MAC:");
- StrnCat (Str, MacString, sizeof (EFI_MAC_ADDRESS) * 2);
- StrCat (Str, L")");
+ StrCpyS (Str, 26 + sizeof (EFI_MAC_ADDRESS) * 2 + 1, L"VLAN Configuration (MAC:");
+ StrnCatS (Str, 26 + sizeof (EFI_MAC_ADDRESS) * 2 + 1 - StrLen(L"VLAN Configuration (MAC:"), MacString, sizeof (EFI_MAC_ADDRESS) * 2);
+ StrCatS (Str, 2, L")");
HiiSetString (
HiiHandle,
STRING_TOKEN (STR_VLAN_FORM_SET_TITLE_HELP),
Str,
NULL

[Zhang Lubo]

Replace unsafe string functions with new added safe string functions.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <***@intel.com>
---
MdeModulePkg/Library/DxeNetLib/DxeNetLib.c | 4 ++--
MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c | 2 +-
MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c | 2 +-
.../Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c | 2 +-
MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c | 2 +-
.../Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c | 4 ++--
.../Universal/Network/Mtftp4Dxe/Mtftp4Support.c | 13 ++++++++-----
.../Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c | 17 +++++++++--------
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.c | 12 +++++++-----
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.h | 11 +++++++----
.../Universal/Network/VlanConfigDxe/VlanConfigImpl.c | 12 ++++++------
11 files changed, 45 insertions(+), 36 deletions(-)

diff --git a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
index 467b822..cb5a8e6 100644
--- a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
+++ b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
@@ -2625,11 +2625,11 @@ NetLibDefaultAddressIsStatic (
Len = StrLen (ConfigHdr);
ConfigResp = AllocateZeroPool ((Len + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
if (ConfigResp == NULL) {
goto ON_EXIT;
}
- StrCpy (ConfigResp, ConfigHdr);
+ StrCpyS (ConfigResp, (Len + NIC_ITEM_CONFIG_SIZE * 2 + 100), ConfigHdr);

String = ConfigResp + Len;
UnicodeSPrint (
String,
(8 + 4 + 7 + 4 + 1) * sizeof (CHAR16),
@@ -3385,11 +3385,11 @@ NetLibIp6ToStr (

if ((UINTN)Ptr - (UINTN)Buffer > StringSize) {
return EFI_BUFFER_TOO_SMALL;
}

- StrCpy (String, Buffer);
+ StrCpyS (String, StringSize / 2, Buffer);

return EFI_SUCCESS;
}

/**
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
index e263f0e..75fe12f 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
@@ -776,11 +776,11 @@ IScsiFormCallback (
IScsiUnicodeStrToAsciiStr (IfrNvData->TargetName, IScsiName);
Status = IScsiNormalizeName (IScsiName, AsciiStrLen (IScsiName));
if (EFI_ERROR (Status)) {
CreatePopUp (EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE, &Key, L"Invalid iSCSI Name!", NULL);
} else {
- AsciiStrCpy (Private->Current->SessionConfigData.TargetName, IScsiName);
+ AsciiStrCpyS (Private->Current->SessionConfigData.TargetName, ISCSI_NAME_MAX_SIZE, IScsiName);
}

break;

case KEY_DHCP_ENABLE:
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
index 79e7093..10ef629 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
@@ -156,11 +156,11 @@ IScsiDhcpExtractRootPath (
Status = IScsiNormalizeName (Field->Str, AsciiStrLen (Field->Str));
if (EFI_ERROR (Status)) {
goto ON_EXIT;
}

- AsciiStrCpy (ConfigNvData->TargetName, Field->Str);
+ AsciiStrCpyS (ConfigNvData->TargetName, ISCSI_NAME_MAX_SIZE, Field->Str);

ON_EXIT:

FreePool (TmpStr);

diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
index da14105..e3576c1 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
@@ -242,11 +242,11 @@ IScsiExtScsiPassThruBuildDevicePath (
break;
}

CopyMem (&Node->Iscsi.Lun, ConfigNvData->BootLun, sizeof (UINT64));
Node->Iscsi.TargetPortalGroupTag = Session->TargetPortalGroupTag;
- AsciiStrCpy ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), ConfigNvData->TargetName);
+ AsciiStrCpyS ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), AsciiStrLen (ConfigNvData->TargetName) + 1, ConfigNvData->TargetName);

*DevicePath = (EFI_DEVICE_PATH_PROTOCOL *) Node;

return EFI_SUCCESS;
}
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
index 1cb1fb8..85a23a2 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
@@ -202,11 +202,11 @@ IScsiLunToUnicodeStr (
TempStr = Str;

for (Index = 0; Index < 4; Index++) {

if ((Lun[2 * Index] | Lun[2 * Index + 1]) == 0) {
- StrCpy (TempStr, L"0-");
+ CopyMem(TempStr, L"0-", StrSize(L"0-"));
} else {
TempStr[0] = (CHAR16) IScsiHexString[Lun[2 * Index] >> 4];
TempStr[1] = (CHAR16) IScsiHexString[Lun[2 * Index] & 0x0F];
TempStr[2] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] >> 4];
TempStr[3] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] & 0x0F];
diff --git a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
index 89e1dda..7be3e87 100644
--- a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
+++ b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
@@ -485,14 +485,14 @@ Ip4DeviceExtractConfig (
Size = Size + 1;
Size = Size + StrLen (FormResult) + 1;
*Results = AllocateZeroPool (Size * sizeof (CHAR16));
ASSERT (*Results != NULL);
StrPointer = *Results;
- StrCpy (StrPointer, DeviceResult);
+ StrCpyS (StrPointer, Size, DeviceResult);
StrPointer = StrPointer + StrLen (StrPointer);
*StrPointer = L'&';
- StrCpy (StrPointer + 1, FormResult);
+ StrCpyS (StrPointer + 1, StrLen (FormResult) + 1, FormResult);
FreePool (DeviceResult);
FreePool (FormResult);
} else if (HiiIsConfigHdrMatch (Request, &gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
*Results = DeviceResult;
} else if (HiiIsConfigHdrMatch (Request, &gNicIp4ConfigNvDataGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
diff --git a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
index df79c85..85bdf5a 100644
--- a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
+++ b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
@@ -317,21 +317,24 @@ Mtftp4SendRequest (
Packet = (EFI_MTFTP4_PACKET *) NetbufAllocSpace (Nbuf, Len, FALSE);
ASSERT (Packet != NULL);

Packet->OpCode = HTONS (Instance->Operation);
Cur = Packet->Rrq.Filename;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Token->Filename);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - 2, (CHAR8 *) Token->Filename);
Cur += AsciiStrLen ((CHAR8 *) Token->Filename) + 1;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Mode);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - (AsciiStrLen ((CHAR8 *) Token->Filename) + 1), (CHAR8 *) Mode);
Cur += AsciiStrLen ((CHAR8 *) Mode) + 1;
+ Len -= ((UINT32) AsciiStrLen ((CHAR8 *) Token->Filename) + (UINT32) AsciiStrLen ((CHAR8 *) Mode) + 4);

for (Index = 0; Index < Token->OptionCount; ++Index) {
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].OptionStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].OptionStr);
Cur += AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1);

- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].ValueStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].ValueStr);
Cur += AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1);
}

return Mtftp4SendPacket (Instance, Nbuf);
}

@@ -369,11 +372,11 @@ Mtftp4SendError (
ASSERT (TftpError != NULL);

TftpError->OpCode = HTONS (EFI_MTFTP4_OPCODE_ERROR);
TftpError->Error.ErrorCode = HTONS (ErrCode);

- AsciiStrCpy ((CHAR8 *) TftpError->Error.ErrorMessage, (CHAR8 *) ErrInfo);
+ AsciiStrCpyS ((CHAR8 *) TftpError->Error.ErrorMessage, Len, (CHAR8 *) ErrInfo);

return Mtftp4SendPacket (Instance, Packet);
}


diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
index aa73132..20747ed 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
@@ -58,11 +58,11 @@ PxeBcCheckPacket (
Status = EFI_SUCCESS;

if (Packet->OpCode == EFI_MTFTP4_OPCODE_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);
+ AsciiStrnCpyS (Private->Mode.TftpError.ErrorString, PXE_MTFTP_ERROR_STRING_LENGTH, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}

if (Callback != NULL) {

@@ -133,17 +133,17 @@ PxeBcTftpGetFileSize (

return Status;
}

ReqOpt[0].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_TSIZE_INDEX];
- UtoA10 (0, (CHAR8 *) OptBuf);
+ UtoA10 (0, (CHAR8 *) OptBuf, 128);
ReqOpt[0].ValueStr = OptBuf;

if (BlockSize != NULL) {
ReqOpt[1].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[1].ValueStr = ReqOpt[0].ValueStr + AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr, 128 - (AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1));
OptCnt++;
}

Status = Mtftp4->GetInfo (
Mtftp4,
@@ -158,12 +158,13 @@ PxeBcTftpGetFileSize (

if (EFI_ERROR (Status)) {
if (Status == EFI_TFTP_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (
- Private->Mode.TftpError.ErrorString,
+ AsciiStrnCpyS (
+ Private->Mode.TftpError.ErrorString,
+ PXE_MTFTP_ERROR_STRING_LENGTH,
(CHAR8 *) Packet->Error.ErrorMessage,
PXE_MTFTP_ERROR_STRING_LENGTH
);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}
@@ -259,11 +260,11 @@ PxeBcTftpReadFile (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
@@ -342,11 +343,11 @@ PxeBcTftpWriteFile (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
@@ -416,11 +417,11 @@ PxeBcTftpReadDirectory (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
index 327e4a2..51d1a5a 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
@@ -138,20 +138,22 @@ CvtNum (


/**
Convert unsigned int number to decimal number.

- @param Number The unsigned int number will be converted.
- @param Buffer Pointer to the buffer to store the decimal number after transform.
-
+ @param Number The unsigned int number will be converted.
+ @param Buffer Pointer to the buffer to store the decimal number after transform.
+ @param[in] BufferSize The maxsize of the buffer.
+
@return the length of the number after transform.

**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
)
{
UINTN Index;
CHAR8 TempStr[64];

@@ -162,11 +164,11 @@ UtoA10 (
Index--;
TempStr[Index] = (CHAR8) ('0' + (Number % 10));
Number = Number / 10;
} while (Number != 0);

- AsciiStrCpy (Buffer, &TempStr[Index]);
+ AsciiStrCpyS (Buffer, BufferSize, &TempStr[Index]);

return AsciiStrLen (Buffer);
}


diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
index 96f48f5..89a6afa 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
@@ -80,20 +80,23 @@ CvtNum (


/**
Convert unsigned int number to decimal number.

- @param Number The unsigned int number will be converted.
- @param Buffer Pointer to the buffer to store the decimal number after transform.
-
+ @param Number The unsigned int number will be converted.
+ @param Buffer Pointer to the buffer to store the decimal number after transform.
+ @param[in] BufferSize The maxsize of the buffer.
+
@return the length of the number after transform.

**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
+
);


/**
Convert ASCII numeric string to a UINTN value.
diff --git a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
index fd8555e..baa3eb3 100644
--- a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
+++ b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
@@ -410,21 +410,21 @@ VlanUpdateForm (

ZeroMem (PrivateData->VlanId, MAX_VLAN_NUMBER);
for (Index = 0; Index < NumberOfVlan; Index++) {
String = VlanStr;

- StrCpy (String, L" VLAN ID:");
+ StrCpyS (String, 30, L" VLAN ID:");
String += 10;
//
// Pad VlanId string up to 4 characters with space
//
DigitalCount = UnicodeValueToString (VlanIdStr, 0, VlanData[Index].VlanId, 5);
SetMem16 (String, (4 - DigitalCount) * sizeof (CHAR16), L' ');
- StrCpy (String + 4 - DigitalCount, VlanIdStr);
+ StrCpyS (String + 4 - DigitalCount, 30 - 10 - (4 - DigitalCount), VlanIdStr);
String += 4;

- StrCpy (String, L", Priority:");
+ StrCpyS (String, 30 - 10 - (4 - DigitalCount) - 4, L", Priority:");
String += 11;
String += UnicodeValueToString (String, 0, VlanData[Index].Priority, 4);
*String = 0;

StringId = HiiSetString (PrivateData->HiiHandle, 0, VlanStr, NULL);
@@ -557,13 +557,13 @@ InstallVlanConfigForm (
if (EFI_ERROR (Status)) {
return Status;
}
PrivateData->MacString = MacString;

- StrCpy (Str, L"VLAN Configuration (MAC:");
- StrnCat (Str, MacString, sizeof (EFI_MAC_ADDRESS) * 2);
- StrCat (Str, L")");
+ StrCpyS (Str, 26 + sizeof (EFI_MAC_ADDRESS) * 2 + 1, L"VLAN Configuration (MAC:");
+ StrnCatS (Str, 26 + sizeof (EFI_MAC_ADDRESS) * 2 + 1 - StrLen(L"VLAN Configuration (MAC:"), MacString, sizeof (EFI_MAC_ADDRESS) * 2);
+ StrCatS (Str, 2, L")");
HiiSetString (
HiiHandle,
STRING_TOKEN (STR_VLAN_FORM_SET_TITLE_HELP),
Str,
NULL

[Carsey, Jaben]

I had a few comments. The NULL-terminator one is the only real risk.

-----Original Message-----
Sent: Tuesday, June 30, 2015 1:26 AM
Subject: [edk2] [patch 1/2] MdeModulePkg: Replace unsafe string functions.
Replace unsafe string functions with new added safe string functions.
Contributed-under: TianoCore Contribution Agreement 1.0
---
MdeModulePkg/Library/DxeNetLib/DxeNetLib.c | 4 ++--
MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c | 2 +-
MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c | 2 +-
.../Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c | 2 +-
MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c | 2 +-
.../Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c | 4 ++--
.../Universal/Network/Mtftp4Dxe/Mtftp4Support.c | 13 ++++++++-----
.../Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c | 17 +++++++++--------
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.c | 12 +++++++-----
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.h | 11 +++++++----
.../Universal/Network/VlanConfigDxe/VlanConfigImpl.c | 12 ++++++------
11 files changed, 45 insertions(+), 36 deletions(-)
diff --git a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
index 467b822..cb5a8e6 100644
--- a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
+++ b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
@@ -2625,11 +2625,11 @@ NetLibDefaultAddressIsStatic (
Len = StrLen (ConfigHdr);
ConfigResp = AllocateZeroPool ((Len + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
if (ConfigResp == NULL) {
goto ON_EXIT;
}
- StrCpy (ConfigResp, ConfigHdr);
+ StrCpyS (ConfigResp, (Len + NIC_ITEM_CONFIG_SIZE * 2 + 100), ConfigHdr);

You could use AllocateCopyPool here and make it easier to read.

String = ConfigResp + Len;
UnicodeSPrint (
String,
(8 + 4 + 7 + 4 + 1) * sizeof (CHAR16),
@@ -3385,11 +3385,11 @@ NetLibIp6ToStr (
if ((UINTN)Ptr - (UINTN)Buffer > StringSize) {
return EFI_BUFFER_TOO_SMALL;
}
- StrCpy (String, Buffer);
+ StrCpyS (String, StringSize / 2, Buffer);
return EFI_SUCCESS;
}
/**
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
index e263f0e..75fe12f 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
@@ -776,11 +776,11 @@ IScsiFormCallback (
IScsiUnicodeStrToAsciiStr (IfrNvData->TargetName, IScsiName);
Status = IScsiNormalizeName (IScsiName, AsciiStrLen (IScsiName));
if (EFI_ERROR (Status)) {
CreatePopUp (EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE, &Key, L"Invalid iSCSI Name!", NULL);
} else {
- AsciiStrCpy (Private->Current->SessionConfigData.TargetName, IScsiName);
+ AsciiStrCpyS (Private->Current->SessionConfigData.TargetName, ISCSI_NAME_MAX_SIZE, IScsiName);
}
break;
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
index 79e7093..10ef629 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
@@ -156,11 +156,11 @@ IScsiDhcpExtractRootPath (
Status = IScsiNormalizeName (Field->Str, AsciiStrLen (Field->Str));
if (EFI_ERROR (Status)) {
goto ON_EXIT;
}
- AsciiStrCpy (ConfigNvData->TargetName, Field->Str);
+ AsciiStrCpyS (ConfigNvData->TargetName, ISCSI_NAME_MAX_SIZE, Field->Str);
FreePool (TmpStr);
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
index da14105..e3576c1 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
@@ -242,11 +242,11 @@ IScsiExtScsiPassThruBuildDevicePath (
break;
}
CopyMem (&Node->Iscsi.Lun, ConfigNvData->BootLun, sizeof (UINT64));
Node->Iscsi.TargetPortalGroupTag = Session->TargetPortalGroupTag;
- AsciiStrCpy ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), ConfigNvData->TargetName);
+ AsciiStrCpyS ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), AsciiStrLen (ConfigNvData->TargetName) + 1, ConfigNvData-

Post by Zhang Lubo
TargetName);

*DevicePath = (EFI_DEVICE_PATH_PROTOCOL *) Node;
return EFI_SUCCESS;
}
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
index 1cb1fb8..85a23a2 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
@@ -202,11 +202,11 @@ IScsiLunToUnicodeStr (
TempStr = Str;
for (Index = 0; Index < 4; Index++) {
if ((Lun[2 * Index] | Lun[2 * Index + 1]) == 0) {
- StrCpy (TempStr, L"0-");
+ CopyMem(TempStr, L"0-", StrSize(L"0-"));

Do you care about the NULL-terminator?

} else {
TempStr[0] = (CHAR16) IScsiHexString[Lun[2 * Index] >> 4];
TempStr[1] = (CHAR16) IScsiHexString[Lun[2 * Index] & 0x0F];
TempStr[2] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] >> 4];
TempStr[3] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] & 0x0F];
diff --git a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
index 89e1dda..7be3e87 100644
--- a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
+++ b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
@@ -485,14 +485,14 @@ Ip4DeviceExtractConfig (
Size = Size + 1;
Size = Size + StrLen (FormResult) + 1;
*Results = AllocateZeroPool (Size * sizeof (CHAR16));
ASSERT (*Results != NULL);
StrPointer = *Results;
- StrCpy (StrPointer, DeviceResult);
+ StrCpyS (StrPointer, Size, DeviceResult);

Another place for AllocateCopyPool

StrPointer = StrPointer + StrLen (StrPointer);
*StrPointer = L'&';
- StrCpy (StrPointer + 1, FormResult);
+ StrCpyS (StrPointer + 1, StrLen (FormResult) + 1, FormResult);
FreePool (DeviceResult);
FreePool (FormResult);
} else if (HiiIsConfigHdrMatch (Request, &gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
*Results = DeviceResult;
} else if (HiiIsConfigHdrMatch (Request, &gNicIp4ConfigNvDataGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
diff --git a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
index df79c85..85bdf5a 100644
--- a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
+++ b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
@@ -317,21 +317,24 @@ Mtftp4SendRequest (
Packet = (EFI_MTFTP4_PACKET *) NetbufAllocSpace (Nbuf, Len, FALSE);
ASSERT (Packet != NULL);
Packet->OpCode = HTONS (Instance->Operation);
Cur = Packet->Rrq.Filename;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Token->Filename);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - 2, (CHAR8 *) Token->Filename);
Cur += AsciiStrLen ((CHAR8 *) Token->Filename) + 1;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Mode);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - (AsciiStrLen ((CHAR8 *) Token->Filename) + 1), (CHAR8 *) Mode);
Cur += AsciiStrLen ((CHAR8 *) Mode) + 1;
+ Len -= ((UINT32) AsciiStrLen ((CHAR8 *) Token->Filename) + (UINT32) AsciiStrLen ((CHAR8 *) Mode) + 4);
for (Index = 0; Index < Token->OptionCount; ++Index) {
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].OptionStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].OptionStr);
Cur += AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1);
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].ValueStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].ValueStr);
Cur += AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1);
}
return Mtftp4SendPacket (Instance, Nbuf);
}
@@ -369,11 +372,11 @@ Mtftp4SendError (
ASSERT (TftpError != NULL);
TftpError->OpCode = HTONS (EFI_MTFTP4_OPCODE_ERROR);
TftpError->Error.ErrorCode = HTONS (ErrCode);
- AsciiStrCpy ((CHAR8 *) TftpError->Error.ErrorMessage, (CHAR8 *) ErrInfo);
+ AsciiStrCpyS ((CHAR8 *) TftpError->Error.ErrorMessage, Len, (CHAR8 *) ErrInfo);
return Mtftp4SendPacket (Instance, Packet);
}
diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
index aa73132..20747ed 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
@@ -58,11 +58,11 @@ PxeBcCheckPacket (
Status = EFI_SUCCESS;
if (Packet->OpCode == EFI_MTFTP4_OPCODE_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);
+ AsciiStrnCpyS (Private->Mode.TftpError.ErrorString, PXE_MTFTP_ERROR_STRING_LENGTH, (CHAR8 *) Packet-

Post by Zhang Lubo
Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);

Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}
if (Callback != NULL) {
@@ -133,17 +133,17 @@ PxeBcTftpGetFileSize (
return Status;
}
ReqOpt[0].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_TSIZE_INDEX];
- UtoA10 (0, (CHAR8 *) OptBuf);
+ UtoA10 (0, (CHAR8 *) OptBuf, 128);
ReqOpt[0].ValueStr = OptBuf;
if (BlockSize != NULL) {
ReqOpt[1].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[1].ValueStr = ReqOpt[0].ValueStr + AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr, 128 - (AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1));
OptCnt++;
}
Status = Mtftp4->GetInfo (
Mtftp4,
@@ -158,12 +158,13 @@ PxeBcTftpGetFileSize (
if (EFI_ERROR (Status)) {
if (Status == EFI_TFTP_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (
- Private->Mode.TftpError.ErrorString,
+ AsciiStrnCpyS (
+ Private->Mode.TftpError.ErrorString,
+ PXE_MTFTP_ERROR_STRING_LENGTH,
(CHAR8 *) Packet->Error.ErrorMessage,
PXE_MTFTP_ERROR_STRING_LENGTH
);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}
@@ -259,11 +260,11 @@ PxeBcTftpReadFile (
if (BlockSize != NULL) {
ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}
Token.Event = NULL;
Token.OverrideData = NULL;
@@ -342,11 +343,11 @@ PxeBcTftpWriteFile (
if (BlockSize != NULL) {
ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}
Token.Event = NULL;
Token.OverrideData = NULL;
@@ -416,11 +417,11 @@ PxeBcTftpReadDirectory (
if (BlockSize != NULL) {
ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, 128);
OptCnt++;
}
Token.Event = NULL;
Token.OverrideData = NULL;
diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
index 327e4a2..51d1a5a 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
@@ -138,20 +138,22 @@ CvtNum (
/**
Convert unsigned int number to decimal number.
-
+
@return the length of the number after transform.
**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
)
{
UINTN Index;
CHAR8 TempStr[64];
@@ -162,11 +164,11 @@ UtoA10 (
Index--;
TempStr[Index] = (CHAR8) ('0' + (Number % 10));
Number = Number / 10;
} while (Number != 0);
- AsciiStrCpy (Buffer, &TempStr[Index]);
+ AsciiStrCpyS (Buffer, BufferSize, &TempStr[Index]);
return AsciiStrLen (Buffer);
}
diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
index 96f48f5..89a6afa 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
@@ -80,20 +80,23 @@ CvtNum (
/**
Convert unsigned int number to decimal number.
-
+
@return the length of the number after transform.
**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
+
);
/**
Convert ASCII numeric string to a UINTN value.
diff --git a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
index fd8555e..baa3eb3 100644
--- a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
+++ b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
@@ -410,21 +410,21 @@ VlanUpdateForm (
ZeroMem (PrivateData->VlanId, MAX_VLAN_NUMBER);
for (Index = 0; Index < NumberOfVlan; Index++) {
String = VlanStr;
- StrCpy (String, L" VLAN ID:");
+ StrCpyS (String, 30, L" VLAN ID:");
String += 10;
//
// Pad VlanId string up to 4 characters with space
//
DigitalCount = UnicodeValueToString (VlanIdStr, 0, VlanData[Index].VlanId, 5);
SetMem16 (String, (4 - DigitalCount) * sizeof (CHAR16), L' ');
- StrCpy (String + 4 - DigitalCount, VlanIdStr);
+ StrCpyS (String + 4 - DigitalCount, 30 - 10 - (4 - DigitalCount), VlanIdStr);
String += 4;
- StrCpy (String, L", Priority:");
+ StrCpyS (String, 30 - 10 - (4 - DigitalCount) - 4, L", Priority:");
String += 11;
String += UnicodeValueToString (String, 0, VlanData[Index].Priority, 4);
*String = 0;
StringId = HiiSetString (PrivateData->HiiHandle, 0, VlanStr, NULL);
@@ -557,13 +557,13 @@ InstallVlanConfigForm (
if (EFI_ERROR (Status)) {
return Status;
}
PrivateData->MacString = MacString;
- StrCpy (Str, L"VLAN Configuration (MAC:");
- StrnCat (Str, MacString, sizeof (EFI_MAC_ADDRESS) * 2);
- StrCat (Str, L")");
+ StrCpyS (Str, 26 + sizeof (EFI_MAC_ADDRESS) * 2 + 1, L"VLAN Configuration (MAC:");
+ StrnCatS (Str, 26 + sizeof (EFI_MAC_ADDRESS) * 2 + 1 - StrLen(L"VLAN Configuration (MAC:"), MacString, sizeof
(EFI_MAC_ADDRESS) * 2);
+ StrCatS (Str, 2, L")");
HiiSetString (
HiiHandle,
STRING_TOKEN (STR_VLAN_FORM_SET_TITLE_HELP),
Str,
NULL
--
1.9.5.msysgit.1
------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/
_______________________________________________
edk2-devel mailing list
https://lists.sourceforge.net/lists/listinfo/edk2-devel

[Zhang Lubo]

Replace unsafe string functions with new added safe string functions.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <***@intel.com>
---
MdeModulePkg/Library/DxeNetLib/DxeNetLib.c | 7 +++----
.../Universal/Network/IScsiDxe/IScsiConfig.c | 4 ++--
.../Universal/Network/IScsiDxe/IScsiDhcp.c | 4 ++--
.../Network/IScsiDxe/IScsiExtScsiPassThru.c | 4 ++--
.../Universal/Network/IScsiDxe/IScsiMisc.c | 4 ++--
.../Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c | 7 +++----
.../Universal/Network/Mtftp4Dxe/Mtftp4Support.c | 15 +++++++++------
.../Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c | 22 +++++++++++-----------
.../Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h | 3 ++-
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.c | 14 ++++++++------
.../Universal/Network/UefiPxeBcDxe/PxeBcSupport.h | 11 +++++++----
.../Network/VlanConfigDxe/VlanConfigImpl.c | 14 +++++++-------
12 files changed, 58 insertions(+), 51 deletions(-)

diff --git a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
index 467b822..a860e79 100644
--- a/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
+++ b/MdeModulePkg/Library/DxeNetLib/DxeNetLib.c
@@ -1,9 +1,9 @@
/** @file
Network library.

-Copyright (c) 2005 - 2013, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -2621,15 +2621,14 @@ NetLibDefaultAddressIsStatic (
if (ConfigHdr == NULL) {
return TRUE;
}

Len = StrLen (ConfigHdr);
- ConfigResp = AllocateZeroPool ((Len + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
+ ConfigResp = AllocateCopyPool((Len + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16), ConfigHdr);
if (ConfigResp == NULL) {
goto ON_EXIT;
}
- StrCpy (ConfigResp, ConfigHdr);

String = ConfigResp + Len;
UnicodeSPrint (
String,
(8 + 4 + 7 + 4 + 1) * sizeof (CHAR16),
@@ -3385,11 +3384,11 @@ NetLibIp6ToStr (

if ((UINTN)Ptr - (UINTN)Buffer > StringSize) {
return EFI_BUFFER_TOO_SMALL;
}

- StrCpy (String, Buffer);
+ StrCpyS (String, StringSize / sizeof (CHAR16), Buffer);

return EFI_SUCCESS;
}

/**
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
index e263f0e..7b77fd3 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiConfig.c
@@ -1,9 +1,9 @@
/** @file
Helper functions for configuring or getting the parameters relating to iSCSI.

-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -776,11 +776,11 @@ IScsiFormCallback (
IScsiUnicodeStrToAsciiStr (IfrNvData->TargetName, IScsiName);
Status = IScsiNormalizeName (IScsiName, AsciiStrLen (IScsiName));
if (EFI_ERROR (Status)) {
CreatePopUp (EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE, &Key, L"Invalid iSCSI Name!", NULL);
} else {
- AsciiStrCpy (Private->Current->SessionConfigData.TargetName, IScsiName);
+ AsciiStrCpyS (Private->Current->SessionConfigData.TargetName, ISCSI_NAME_MAX_SIZE, IScsiName);
}

break;

case KEY_DHCP_ENABLE:
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
index 79e7093..d574ce2 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiDhcp.c
@@ -1,9 +1,9 @@
/** @file
iSCSI DHCP related configuration routines.

-Copyright (c) 2004 - 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -156,11 +156,11 @@ IScsiDhcpExtractRootPath (
Status = IScsiNormalizeName (Field->Str, AsciiStrLen (Field->Str));
if (EFI_ERROR (Status)) {
goto ON_EXIT;
}

- AsciiStrCpy (ConfigNvData->TargetName, Field->Str);
+ AsciiStrCpyS (ConfigNvData->TargetName, ISCSI_NAME_MAX_SIZE, Field->Str);

ON_EXIT:

FreePool (TmpStr);

diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
index da14105..e9e37b7 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiExtScsiPassThru.c
@@ -1,9 +1,9 @@
/** @file
The IScsi's EFI_EXT_SCSI_PASS_THRU_PROTOCOL driver.

-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -242,11 +242,11 @@ IScsiExtScsiPassThruBuildDevicePath (
break;
}

CopyMem (&Node->Iscsi.Lun, ConfigNvData->BootLun, sizeof (UINT64));
Node->Iscsi.TargetPortalGroupTag = Session->TargetPortalGroupTag;
- AsciiStrCpy ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), ConfigNvData->TargetName);
+ AsciiStrCpyS ((CHAR8 *) Node + sizeof (ISCSI_DEVICE_PATH), AsciiStrLen (ConfigNvData->TargetName) + 1, ConfigNvData->TargetName);

*DevicePath = (EFI_DEVICE_PATH_PROTOCOL *) Node;

return EFI_SUCCESS;
}
diff --git a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
index 1cb1fb8..61c407e 100644
--- a/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
+++ b/MdeModulePkg/Universal/Network/IScsiDxe/IScsiMisc.c
@@ -1,9 +1,9 @@
/** @file
Miscellaneous routines for iSCSI driver.

-Copyright (c) 2004 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -202,11 +202,11 @@ IScsiLunToUnicodeStr (
TempStr = Str;

for (Index = 0; Index < 4; Index++) {

if ((Lun[2 * Index] | Lun[2 * Index + 1]) == 0) {
- StrCpy (TempStr, L"0-");
+ CopyMem(TempStr, L"0-", sizeof (L"0-"));
} else {
TempStr[0] = (CHAR16) IScsiHexString[Lun[2 * Index] >> 4];
TempStr[1] = (CHAR16) IScsiHexString[Lun[2 * Index] & 0x0F];
TempStr[2] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] >> 4];
TempStr[3] = (CHAR16) IScsiHexString[Lun[2 * Index + 1] & 0x0F];
diff --git a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
index 89e1dda..81c9263 100644
--- a/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
+++ b/MdeModulePkg/Universal/Network/Ip4ConfigDxe/Ip4ConfigNv.c
@@ -1,9 +1,9 @@
/** @file
Helper functions for configuring or getting the parameters relating to Ip4.

-Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -482,17 +482,16 @@ Ip4DeviceExtractConfig (

if (Request == NULL) {
Size = StrLen (DeviceResult);
Size = Size + 1;
Size = Size + StrLen (FormResult) + 1;
- *Results = AllocateZeroPool (Size * sizeof (CHAR16));
+ *Results = AllocateCopyPool(Size * sizeof (CHAR16), DeviceResult);
ASSERT (*Results != NULL);
StrPointer = *Results;
- StrCpy (StrPointer, DeviceResult);
StrPointer = StrPointer + StrLen (StrPointer);
*StrPointer = L'&';
- StrCpy (StrPointer + 1, FormResult);
+ StrCpyS (StrPointer + 1, StrLen (FormResult) + 1, FormResult);
FreePool (DeviceResult);
FreePool (FormResult);
} else if (HiiIsConfigHdrMatch (Request, &gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
*Results = DeviceResult;
} else if (HiiIsConfigHdrMatch (Request, &gNicIp4ConfigNvDataGuid, EFI_NIC_IP4_CONFIG_VARIABLE)) {
diff --git a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
index df79c85..9ac6363 100644
--- a/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
+++ b/MdeModulePkg/Universal/Network/Mtftp4Dxe/Mtftp4Support.c
@@ -1,9 +1,9 @@
/** @file
Support routines for Mtftp.

-Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2006 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php<BR>

@@ -317,21 +317,24 @@ Mtftp4SendRequest (
Packet = (EFI_MTFTP4_PACKET *) NetbufAllocSpace (Nbuf, Len, FALSE);
ASSERT (Packet != NULL);

Packet->OpCode = HTONS (Instance->Operation);
Cur = Packet->Rrq.Filename;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Token->Filename);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - 2, (CHAR8 *) Token->Filename);
Cur += AsciiStrLen ((CHAR8 *) Token->Filename) + 1;
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Mode);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len - (AsciiStrLen ((CHAR8 *) Token->Filename) + 1), (CHAR8 *) Mode);
Cur += AsciiStrLen ((CHAR8 *) Mode) + 1;
+ Len -= ((UINT32) AsciiStrLen ((CHAR8 *) Token->Filename) + (UINT32) AsciiStrLen ((CHAR8 *) Mode) + 4);

for (Index = 0; Index < Token->OptionCount; ++Index) {
- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].OptionStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].OptionStr);
Cur += AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) Options[Index].OptionStr) + 1);

- Cur = (UINT8 *) AsciiStrCpy ((CHAR8 *) Cur, (CHAR8 *) Options[Index].ValueStr);
+ Cur = (UINT8 *) AsciiStrCpyS ((CHAR8 *) Cur, Len, (CHAR8 *) Options[Index].ValueStr);
Cur += AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1;
+ Len -= (AsciiStrLen ((CHAR8 *) (CHAR8 *) Options[Index].ValueStr) + 1);
}

return Mtftp4SendPacket (Instance, Nbuf);
}

@@ -369,11 +372,11 @@ Mtftp4SendError (
ASSERT (TftpError != NULL);

TftpError->OpCode = HTONS (EFI_MTFTP4_OPCODE_ERROR);
TftpError->Error.ErrorCode = HTONS (ErrCode);

- AsciiStrCpy ((CHAR8 *) TftpError->Error.ErrorMessage, (CHAR8 *) ErrInfo);
+ AsciiStrCpyS ((CHAR8 *) TftpError->Error.ErrorMessage, Len, (CHAR8 *) ErrInfo);

return Mtftp4SendPacket (Instance, Packet);
}


diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
index aa73132..e0c4943 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.c
@@ -1,9 +1,9 @@
/** @file
PxeBc MTFTP functions.

-Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -58,11 +58,11 @@ PxeBcCheckPacket (
Status = EFI_SUCCESS;

if (Packet->OpCode == EFI_MTFTP4_OPCODE_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (Private->Mode.TftpError.ErrorString, (CHAR8 *) Packet->Error.ErrorMessage, PXE_MTFTP_ERROR_STRING_LENGTH);
+ AsciiStrCpyS (Private->Mode.TftpError.ErrorString, PXE_MTFTP_ERROR_STRING_LENGTH, (CHAR8 *) Packet->Error.ErrorMessage);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}

if (Callback != NULL) {

@@ -133,17 +133,17 @@ PxeBcTftpGetFileSize (

return Status;
}

ReqOpt[0].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_TSIZE_INDEX];
- UtoA10 (0, (CHAR8 *) OptBuf);
+ UtoA10 (0, (CHAR8 *) OptBuf, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
ReqOpt[0].ValueStr = OptBuf;

if (BlockSize != NULL) {
ReqOpt[1].OptionStr = (UINT8*)mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[1].ValueStr = ReqOpt[0].ValueStr + AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[1].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX - (AsciiStrLen ((CHAR8 *) ReqOpt[0].ValueStr) + 1));
OptCnt++;
}

Status = Mtftp4->GetInfo (
Mtftp4,
@@ -158,14 +158,14 @@ PxeBcTftpGetFileSize (

if (EFI_ERROR (Status)) {
if (Status == EFI_TFTP_ERROR) {
Private->Mode.TftpErrorReceived = TRUE;
Private->Mode.TftpError.ErrorCode = (UINT8) Packet->Error.ErrorCode;
- AsciiStrnCpy (
- Private->Mode.TftpError.ErrorString,
- (CHAR8 *) Packet->Error.ErrorMessage,
- PXE_MTFTP_ERROR_STRING_LENGTH
+ AsciiStrCpyS (
+ Private->Mode.TftpError.ErrorString,
+ PXE_MTFTP_ERROR_STRING_LENGTH,
+ (CHAR8 *) Packet->Error.ErrorMessage
);
Private->Mode.TftpError.ErrorString[PXE_MTFTP_ERROR_STRING_LENGTH - 1] = '\0';
}
goto ON_ERROR;
}
@@ -259,11 +259,11 @@ PxeBcTftpReadFile (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
@@ -342,11 +342,11 @@ PxeBcTftpWriteFile (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
@@ -416,11 +416,11 @@ PxeBcTftpReadDirectory (

if (BlockSize != NULL) {

ReqOpt[0].OptionStr = (UINT8*) mMtftpOptions[PXE_MTFTP_OPTION_BLKSIZE_INDEX];
ReqOpt[0].ValueStr = OptBuf;
- UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr);
+ UtoA10 (*BlockSize, (CHAR8 *) ReqOpt[0].ValueStr, PXE_MTFTP_OPTBUF_MAXNUM_INDEX);
OptCnt++;
}

Token.Event = NULL;
Token.OverrideData = NULL;
diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
index 9920aff..241b079 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcMtftp.h
@@ -1,9 +1,9 @@
/** @file
Mtftp routines for PxeBc.

-Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -20,10 +20,11 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#define PXE_MTFTP_OPTION_TSIZE_INDEX 2
#define PXE_MTFTP_OPTION_MULTICAST_INDEX 3
#define PXE_MTFTP_OPTION_MAXIMUM_INDEX 4

#define PXE_MTFTP_ERROR_STRING_LENGTH 127
+#define PXE_MTFTP_OPTBUF_MAXNUM_INDEX 128


/**
This function is to get size of a file by Tftp.

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
index 327e4a2..3016da7 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
@@ -1,9 +1,9 @@
/** @file
Support routines for PxeBc.

-Copyright (c) 2007 - 2011, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php

@@ -138,20 +138,22 @@ CvtNum (


/**
Convert unsigned int number to decimal number.

- @param Number The unsigned int number will be converted.
- @param Buffer Pointer to the buffer to store the decimal number after transform.
-
+ @param Number The unsigned int number will be converted.
+ @param Buffer Pointer to the buffer to store the decimal number after transform.
+ @param[in] BufferSize The maxsize of the buffer.
+
@return the length of the number after transform.

**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
)
{
UINTN Index;
CHAR8 TempStr[64];

@@ -162,11 +164,11 @@ UtoA10 (
Index--;
TempStr[Index] = (CHAR8) ('0' + (Number % 10));
Number = Number / 10;
} while (Number != 0);

- AsciiStrCpy (Buffer, &TempStr[Index]);
+ AsciiStrCpyS (Buffer, BufferSize, &TempStr[Index]);

return AsciiStrLen (Buffer);
}


diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
index 96f48f5..89a6afa 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
@@ -80,20 +80,23 @@ CvtNum (


/**
Convert unsigned int number to decimal number.

- @param Number The unsigned int number will be converted.
- @param Buffer Pointer to the buffer to store the decimal number after transform.
-
+ @param Number The unsigned int number will be converted.
+ @param Buffer Pointer to the buffer to store the decimal number after transform.
+ @param[in] BufferSize The maxsize of the buffer.
+
@return the length of the number after transform.

**/
UINTN
UtoA10 (
IN UINTN Number,
- IN CHAR8 *Buffer
+ IN CHAR8 *Buffer,
+ IN UINTN BufferSize
+
);


/**
Convert ASCII numeric string to a UINTN value.
diff --git a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
index fd8555e..b8b2802 100644
--- a/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
+++ b/MdeModulePkg/Universal/Network/VlanConfigDxe/VlanConfigImpl.c
@@ -1,9 +1,9 @@
/** @file
HII Config Access protocol implementation of VLAN configuration module.

-Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions
of the BSD License which accompanies this distribution. The full
text of the license may be found at<BR>
http://opensource.org/licenses/bsd-license.php
@@ -410,21 +410,21 @@ VlanUpdateForm (

ZeroMem (PrivateData->VlanId, MAX_VLAN_NUMBER);
for (Index = 0; Index < NumberOfVlan; Index++) {
String = VlanStr;

- StrCpy (String, L" VLAN ID:");
+ StrCpyS (String, (sizeof (VlanStr) /sizeof (CHAR16)), L" VLAN ID:");
String += 10;
//
// Pad VlanId string up to 4 characters with space
//
DigitalCount = UnicodeValueToString (VlanIdStr, 0, VlanData[Index].VlanId, 5);
SetMem16 (String, (4 - DigitalCount) * sizeof (CHAR16), L' ');
- StrCpy (String + 4 - DigitalCount, VlanIdStr);
+ StrCpyS (String + 4 - DigitalCount, (sizeof (VlanStr) /sizeof (CHAR16)) - 10 - (4 - DigitalCount), VlanIdStr);
String += 4;

- StrCpy (String, L", Priority:");
+ StrCpyS (String, (sizeof (VlanStr) /sizeof (CHAR16)) - 10 - (4 - DigitalCount) - 4, L", Priority:");
String += 11;
String += UnicodeValueToString (String, 0, VlanData[Index].Priority, 4);
*String = 0;

StringId = HiiSetString (PrivateData->HiiHandle, 0, VlanStr, NULL);
@@ -557,13 +557,13 @@ InstallVlanConfigForm (
if (EFI_ERROR (Status)) {
return Status;
}
PrivateData->MacString = MacString;

- StrCpy (Str, L"VLAN Configuration (MAC:");
- StrnCat (Str, MacString, sizeof (EFI_MAC_ADDRESS) * 2);
- StrCat (Str, L")");
+ StrCpyS (Str, 26 + sizeof (EFI_MAC_ADDRESS) * 2 + 1, L"VLAN Configuration (MAC:");
+ StrnCatS (Str, 26 + sizeof (EFI_MAC_ADDRESS) * 2 + 1 - StrLen(L"VLAN Configuration (MAC:"), MacString, sizeof (EFI_MAC_ADDRESS) * 2);
+ StrCatS (Str, 2, L")");
HiiSetString (
HiiHandle,
STRING_TOKEN (STR_VLAN_FORM_SET_TITLE_HELP),
Str,
NULL