[PATCH] NetworkPkg/IScsiDxe: Enhance the check for array boundary


Zhang, Shenglei
 

Array 'TargetUrl' of size 255 may use index value(s) 255 and 256.
So enhance the boundary check to ensure the index is valid.

Cc: Maciej Rabeda <maciej.rabeda@...>
Cc: Jiaxin Wu <jiaxin.wu@...>
Cc: Siyuan Fu <siyuan.fu@...>
Signed-off-by: Shenglei Zhang <shenglei.zhang@...>
---
NetworkPkg/IScsiDxe/IScsiDhcp.c | 2 +-
NetworkPkg/IScsiDxe/IScsiDhcp6.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/NetworkPkg/IScsiDxe/IScsiDhcp.c b/NetworkPkg/IScsiDxe/IScsiDhcp.c
index 7ce9bf575012..afa8a86cd419 100644
--- a/NetworkPkg/IScsiDxe/IScsiDhcp.c
+++ b/NetworkPkg/IScsiDxe/IScsiDhcp.c
@@ -122,7 +122,7 @@ IScsiDhcpExtractRootPath (
//
if ((!NET_IS_DIGIT (*(Field->Str))) && (*(Field->Str) != '[')) {
ConfigNvData->DnsMode = TRUE;
- if (Field->Len > sizeof (ConfigNvData->TargetUrl)) {
+ if ((Field->Len + 2) > sizeof (ConfigNvData->TargetUrl)) {
return EFI_INVALID_PARAMETER;
}
CopyMem (&ConfigNvData->TargetUrl, Field->Str, Field->Len);
diff --git a/NetworkPkg/IScsiDxe/IScsiDhcp6.c b/NetworkPkg/IScsiDxe/IScsiDhcp6.c
index 86a872adeccc..691650b7334f 100644
--- a/NetworkPkg/IScsiDxe/IScsiDhcp6.c
+++ b/NetworkPkg/IScsiDxe/IScsiDhcp6.c
@@ -161,7 +161,7 @@ IScsiDhcp6ExtractRootPath (
// Server name is expressed as domain name, just save it.
//
if (ConfigNvData->DnsMode) {
- if (Field->Len > sizeof (ConfigNvData->TargetUrl)) {
+ if ((Field->Len + 2) > sizeof (ConfigNvData->TargetUrl)) {
return EFI_INVALID_PARAMETER;
}
CopyMem (&ConfigNvData->TargetUrl, Field->Str, Field->Len);
--
2.18.0.windows.1

Join devel@edk2.groups.io to automatically receive all group messages.