From: David Decotigny <decot@googlers.com>

Date: Mon, 28 Jul 2014 21:00:52 -0700
Subject: [PATCH 2/3] Avoid buffer overflow while parsing the cmdline args

Signed-off-by: David Decotigny <decot@googlers.com>
Signed-off-by: Nigel Croxon <nigel.croxon@hp.com>

gnu-efi-3.0/apps/AllocPages.c

@@ -113,7 +113,7 @@ efi_main (EFI_HANDLE image, EFI_SYSTEM_TABLE *systab)
 
 	CHAR16 arglist[MAX_ARGS+1] = {0};
 	CHAR16 *argv[MAX_ARGS];
-	INTN argc = 0;
+	INTN argc, arglen;
 	INTN err = 0;
 #if DEBUG
 	INTN c = 0;
@@ -145,15 +145,19 @@ efi_main (EFI_HANDLE image, EFI_SYSTEM_TABLE *systab)
 #if DEBUG
 	Print(L"Set up arglist\n");
 #endif
-	CopyMem(arglist, info->LoadOptions, info->LoadOptionsSize);
+	arglen = info->LoadOptionsSize;
+	if (arglen > sizeof(arglist))
+		arglen = sizeof(arglist);
+
+	CopyMem(arglist, info->LoadOptions, arglen);
 #if DEBUG
 	Print(L"arglist = <%s>\n", arglist);
 #endif
-	
+
 #if DEBUG
 	Print(L"Now try ParseCmdLine\n");
 #endif
-	argc = ParseCmdLine(argv, arglist, info->LoadOptionsSize);
+	argc = ParseCmdLine(argv, arglist, arglen);
 #if DEBUG
 	Print(L"argc = %d\n", argc);
 #endif
@@ -163,7 +167,7 @@ efi_main (EFI_HANDLE image, EFI_SYSTEM_TABLE *systab)
 		Print(L"argv[%d] = <%s>\n", c, argv[c]);
 	}
 #endif
-	if ( (argc < 3) || (argc > 5) ) {
+	if ( (argc < 4) || (argc > 5) ) {
 		Print(L"Wrong argument count\n");
 		return EFI_SUCCESS;
 	}

gnu-efi-3.0/apps/FreePages.c

@@ -87,7 +87,7 @@ efi_main (EFI_HANDLE image, EFI_SYSTEM_TABLE *systab)
 
 	CHAR16 arglist[MAX_ARGS+1] = {0};
 	CHAR16 *argv[MAX_ARGS];
-	INTN argc = 0;
+	INTN argc, arglen;
 #if DEBUG
 	INTN c = 0;
 #endif
@@ -116,15 +116,19 @@ efi_main (EFI_HANDLE image, EFI_SYSTEM_TABLE *systab)
 #if DEBUG
 	Print(L"Set up arglist\n");
 #endif
-	CopyMem(arglist, info->LoadOptions, info->LoadOptionsSize);
+	arglen = info->LoadOptionsSize;
+	if (arglen > sizeof(arglist))
+		arglen = sizeof(arglist);
+
+	CopyMem(arglist, info->LoadOptions, arglen);
 #if DEBUG
 	Print(L"arglist = <%s>\n", arglist);
 #endif
-	
+
 #if DEBUG
 	Print(L"Now try ParseCmdLine\n");
 #endif
-	argc = ParseCmdLine(argv, arglist, info->LoadOptionsSize);
+	argc = ParseCmdLine(argv, arglist, arglen);
 #if DEBUG
 	Print(L"argc = %d\n", argc);
 #endif