Skip to content

Commit 0e58128

Browse files
vit9696Vitaly Cheptsov
authored andcommitted
BaseTools/VfrCompile: Fix memory issues
Using GCC 13.3.0 discovers an out of bounds memory access in VfrCompile when building DriverSampleDxe. This is also discoverable with ASan. The issue here is that EFI_IFR_TYPE_VALUE is a flexible type and when passed by value for string types only the header part is accessible. Assuming the remainder is zero seems to be ok as gZeroEfiIfrTypeValue is used as a variable source. This change also fixes a warning for new[]/delete[] mismatch discovered by ASan. Signed-off-by: Vitaly Cheptsov <vit9696@protonmail.com>
1 parent 9e8d89f commit 0e58128

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,12 @@ SConfigInfo::SConfigInfo (
8080
return;
8181
}
8282

83+
memset (mValue, 0, mWidth);
84+
85+
if (mWidth > sizeof(EFI_IFR_TYPE_VALUE)) {
86+
mWidth = sizeof(EFI_IFR_TYPE_VALUE);
87+
}
88+
8389
switch (Type) {
8490
case EFI_IFR_TYPE_NUM_SIZE_8 :
8591
memcpy (mValue, &Value.u8, mWidth);
@@ -2380,7 +2386,7 @@ CVfrDefaultStore::ReRegisterDefaultStoreById (
23802386
}
23812387

23822388
if (RefName != NULL) {
2383-
delete pNode->mRefName;
2389+
delete [] pNode->mRefName;
23842390
pNode->mRefName = new CHAR8[strlen (RefName) + 1];
23852391
if (pNode->mRefName != NULL) {
23862392
strcpy (pNode->mRefName, RefName);

0 commit comments

Comments
 (0)