Fix buffer overrun / damaged options passed to second_stage.

start is a UCS-2 character pointer and loader_len is a number of bytes.
Adjust loader_len to count characters before adding to the start pointer.
This commit is contained in:
John S. Gruber 2017-04-24 14:44:59 -04:00 committed by Peter Jones
parent 5c3bf32908
commit f481019157

2
shim.c
View File

@ -2531,7 +2531,7 @@ EFI_STATUS set_second_stage (EFI_HANDLE image_handle)
loader_str[loader_len/2-1] = L'\0'; loader_str[loader_len/2-1] = L'\0';
second_stage = loader_str; second_stage = loader_str;
load_options = remaining_size ? start + loader_len : NULL; load_options = remaining_size ? start + (loader_len/2) : NULL;
load_options_size = remaining_size; load_options_size = remaining_size;
} }