From d30a1689f5b37e78ea189232a8b94a7011dc0dc8 Mon Sep 17 00:00:00 2001 From: John Baldwin Date: Mon, 3 Oct 2022 16:10:44 -0700 Subject: [PATCH] libefivar: Fix a buffer overread. DevPathToTextUsbWWID allocates a separate copy of the SerialNumber string to append a null terminator if the original string is not null terminated. However, by using AllocateCopyPool, it tries to copy 'Length + 1' words from the existing string containing 'Length' characters into the target string. Split the copy out to only copy 'Length' characters instead. Reviewed by: imp, emaste Reported by: GCC 12 -Wstringop-overread Differential Revision: https://reviews.freebsd.org/D36826 --- lib/libefivar/efivar-dp-format.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/libefivar/efivar-dp-format.c b/lib/libefivar/efivar-dp-format.c index 9003b156f7f..186f1cd5f10 100644 --- a/lib/libefivar/efivar-dp-format.c +++ b/lib/libefivar/efivar-dp-format.c @@ -1049,8 +1049,9 @@ DevPathToTextUsbWWID ( // // In case no NULL terminator in SerialNumber, create a new one with NULL terminator // - NewStr = AllocateCopyPool ((Length + 1) * sizeof (CHAR16), SerialNumberStr); + NewStr = AllocatePool ((Length + 1) * sizeof (CHAR16)); ASSERT (NewStr != NULL); + CopyMem (NewStr, SerialNumberStr, Length * sizeof (CHAR16)); NewStr[Length] = 0; SerialNumberStr = NewStr; }