From d780e0595c70cc985dd2fedefcacab1e40db6d3a Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@FreeBSD.org>
Date: Thu, 23 Mar 2017 02:30:57 +0000
Subject: [PATCH] Fix a coverity-discovered NULL pointer dereference.

*** CID 1372598:  Null pointer dereferences  (FORWARD_NULL)
/lib/libefivar/efivar-dp-parse.c: 3612 in UefiDevicePathLibConvertTextToDeviceNode()
   Dereferencing null pointer "FromText".

When ported from Tiano core, I commented this out with an ifdef. That
was in error because we're supposed to fallback to a filepath when
nothing else patches. Instead, restore the original code, but fix
DevPathFromTextFilePath to cope with the conversion to narrow
strings. Also, fix the off-by-one error in the size of the memory it
allocates.

The off by one error is documented in Tiano core bug
https://bugzilla.tianocore.org/show_bug.cgi?id=441

CID: 1372598
Sponsored by: Netflix
---
 lib/libefivar/efivar-dp-parse.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/lib/libefivar/efivar-dp-parse.c b/lib/libefivar/efivar-dp-parse.c
index 70686e990a7..c1ca9b72afc 100644
--- a/lib/libefivar/efivar-dp-parse.c
+++ b/lib/libefivar/efivar-dp-parse.c
@@ -3006,7 +3006,6 @@ DevPathFromTextVenMedia (
            );
 }
 
-#ifndef __FreeBSD__
 /**
   Converts a text device path node to File device path structure.
 
@@ -3023,6 +3022,7 @@ DevPathFromTextFilePath (
 {
   FILEPATH_DEVICE_PATH  *File;
 
+#ifndef __FreeBSD__
   File = (FILEPATH_DEVICE_PATH *) CreateDeviceNode (
                                     MEDIA_DEVICE_PATH,
                                     MEDIA_FILEPATH_DP,
@@ -3030,10 +3030,26 @@ DevPathFromTextFilePath (
                                     );
 
   StrCpyS (File->PathName, StrLen (TextDeviceNode) + 1, TextDeviceNode);
+#else
+  File = (FILEPATH_DEVICE_PATH *) CreateDeviceNode (
+                                    MEDIA_DEVICE_PATH,
+                                    MEDIA_FILEPATH_DP,
+                                    (UINT16) (sizeof (FILEPATH_DEVICE_PATH) + StrLen (TextDeviceNode) + 1)
+                                    );
+
+  /* 
+   * Note: We'd have to change the Tianocore header files to fix this
+   * to not need a cast.  Instead we just cast it here. The Interface
+   * to the user may have issues since this won't be a UCS-2
+   * string. Also note that in the original code, a NUL wasn't
+   * allocated for the end of the string, but we copy that below. This
+   * has been corrected.
+   */
+  StrCpyS ((char *)File->PathName, StrLen (TextDeviceNode) + 1, TextDeviceNode);
+#endif
 
   return (EFI_DEVICE_PATH_PROTOCOL *) File;
 }
-#endif
 
 /**
   Converts a text device path node to Media protocol device path structure.
@@ -3598,7 +3614,6 @@ UefiDevicePathLibConvertTextToDeviceNode (
     }
   }
 
-#ifndef __FreeBSD__
   if (FromText == NULL) {
     //
     // A file path
@@ -3606,9 +3621,6 @@ UefiDevicePathLibConvertTextToDeviceNode (
     FromText = DevPathFromTextFilePath;
     DeviceNode = FromText (DeviceNodeStr);
   } else {
-#else
-  {
-#endif
     DeviceNode = FromText (ParamStr);
     FreePool (ParamStr);
   }