Shell is writing directly to EFI_SIMPLE_TEXT_OUTPUT Mode data in violation of UEFI Spec (Bugzilla Bug 105)

[tianocore-issues]

This issue was created automatically with bugzilla2github

Bugzilla Bug 105

Date: 2016-08-24T20:36:03+00:00
From: @ajfish
To: unassigned <>
CC: jie.b.gao, shala.arshi, yonghong.zhu

Last updated: 2022-02-09T13:51:07+00:00

[tianocore-issues]

Comment 450

Date: 2016-08-24 20:36:03 +0000
From: @ajfish

• Industry Specification: ---
• Release Observed: EDK II Master
• Releases to Fix: EDK II Master
• Target OS: ---
• Bugzilla Assignee(s): unassigned <>

ShellPkg/Application/Shell/ConsoleLogger.c:734
ConsoleInfo->OurConOut.Mode->CursorRow++;

The UEFI Spec states:
The following data values in the SIMPLE_TEXT_OUTPUT_MODE interface are read-only and are changed by using the appropriate interface functions:

When doing page break operations with the edk2 shell our custom ConSpliter was hitting a buffer overflow. I root caused it to the CursorRow incrementing past the end of the screen. I was seeing cases when the Row was getting updated an extra time, not in the console code. I set a watchpoint and caught the shell directly accessing the Consoles Mode structure.

This looks intentional and it is a violation of the UEFI Spec.

master)>git grep "OurConOut.Mode"
Application/Shell/ConsoleLogger.c:72: (*ConsoleInfo)->OurConOut.Mode = gST->ConOut->Mode;
Application/Shell/ConsoleLogger.c:647:// ShellInfoObject.ConsoleInfo->OurConOut.Mode->CursorRow = 0;
Application/Shell/ConsoleLogger.c:648:// ShellInfoObject.ConsoleInfo->OurConOut.Mode->CursorColumn = 0;
Application/Shell/ConsoleLogger.c:704: if (ConsoleInfo->OurConOut.Mode->CursorColumn > 0) {
Application/Shell/ConsoleLogger.c:705: ConsoleInfo->OurConOut.Mode->CursorColumn--;
Application/Shell/ConsoleLogger.c:734: ConsoleInfo->OurConOut.Mode->CursorRow++;
Application/Shell/ConsoleLogger.c:741: ConsoleInfo->OurConOut.Mode->CursorColumn = 0;
Application/Shell/ConsoleLogger.c:747: ConsoleInfo->OurConOut.Mode->CursorColumn++;
Application/Shell/ConsoleLogger.c:751: if ((INTN)ConsoleInfo->ColsPerScreen == ConsoleInfo->OurConOut.Mode->CursorColumn + 1) {
Application/Shell/ConsoleLogger.c:781: ConsoleInfo->OurConOut.Mode->CursorRow++;
Application/Shell/ConsoleLogger.c:782: ConsoleInfo->OurConOut.Mode->CursorColumn = 0;
Application/Shell/ConsoleLogger.c:976: ConsoleInfo->OurConOut.Mode = ConsoleInfo->OldConOut->Mode;

[tianocore-issues]

Comment 537

Date: 2016-09-29 20:25:17 +0000
From: Barton <<jie.b.gao>>

Bug Scrub: Assign to module owner

[tianocore-issues]

Comment 7650

Date: 2019-05-17 13:14:02 +0000
From: shala.arshi

Created attachment 337
data

comment

Attachment: BZ-337-file_105.txt

[tianocore-issues]

Comment 7690

Date: 2019-05-17 16:02:51 +0000
From: Yonghong Zhu <<yonghong.zhu>>

change assignee back to Jaben.

[tianocore-issues]

Comment 18288

Date: 2022-02-09 13:51:07 +0000
From: Jaben Carsey <<jaben.carsey>>

change role