1. Patchew
  2. EDK2
  3. [edk2-devel] [Patch v8 0/2] Disable safe string constraint assertions
  4. View patch

[edk2-devel] [Patch v8 1/2] MdePkg: Fix SafeString performing assertions on runtime checks

Michael D Kinney posted 2 patches 5 years, 8 months ago
There is a newer version of this series
[edk2-devel] [Patch v8 1/2] MdePkg: Fix SafeString performing assertions on runtime checks
Posted by Michael D Kinney 5 years, 8 months ago 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2054

Runtime checks returned via status return code should not work as
assertions to permit parsing not trusted data with SafeString
interfaces.  Replace ASSERT() with a DEBUG_VERBOSE message.

Cc: Andrew Fish <afish@apple.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Bret Barkelew <bret.barkelew@microsoft.com>
Cc: Brian J. Johnson <brian.johnson@hpe.com>
Cc: Chasel Chiu <chasel.chiu@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Marvin H?user <mhaeuser@outlook.de>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Vincent Zimmer <vincent.zimmer@intel.com>
Cc: Zhichao Gao <zhichao.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Signed-off-by: Vitaly Cheptsov <vit9696@protonmail.com>
---
 MdePkg/Include/Library/BaseLib.h    | 111 ---------------------------
 MdePkg/Library/BaseLib/SafeString.c | 115 +---------------------------
 2 files changed, 3 insertions(+), 223 deletions(-)

diff --git a/MdePkg/Include/Library/BaseLib.h b/MdePkg/Include/Library/BaseLib.h
index b0bbe8cef8..8e7b87cbda 100644
--- a/MdePkg/Include/Library/BaseLib.h
+++ b/MdePkg/Include/Library/BaseLib.h
@@ -216,7 +216,6 @@ StrnSizeS (
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -252,7 +251,6 @@ StrCpyS (
 
   If Length > 0 and Destination is not aligned on a 16-bit boundary, then ASSERT().
   If Length > 0 and Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -290,7 +288,6 @@ StrnCpyS (
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -330,7 +327,6 @@ StrCatS (
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -377,12 +373,7 @@ StrnCatS (
   be ignored. Then, the function stops at the first character that is a not a
   valid decimal character or a Null-terminator, whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
 
   If String has no valid decimal digits in the above format, then 0 is stored
   at the location pointed to by Data.
@@ -433,12 +424,7 @@ StrDecimalToUintnS (
   be ignored. Then, the function stops at the first character that is a not a
   valid decimal character or a Null-terminator, whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
 
   If String has no valid decimal digits in the above format, then 0 is stored
   at the location pointed to by Data.
@@ -494,12 +480,7 @@ StrDecimalToUint64S (
   the first character that is a not a valid hexadecimal character or NULL,
   whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
 
   If String has no valid hexadecimal digits in the above format, then 0 is
   stored at the location pointed to by Data.
@@ -555,12 +536,7 @@ StrHexToUintnS (
   the first character that is a not a valid hexadecimal character or NULL,
   whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
 
   If String has no valid hexadecimal digits in the above format, then 0 is
   stored at the location pointed to by Data.
@@ -649,8 +625,6 @@ AsciiStrnSizeS (
 
   This function is similar as strcpy_s defined in C11.
 
-  If an error would be returned, then the function will also ASSERT().
-
   If an error is returned, then the Destination is unmodified.
 
   @param  Destination              A pointer to a Null-terminated Ascii string.
@@ -683,8 +657,6 @@ AsciiStrCpyS (
 
   This function is similar as strncpy_s defined in C11.
 
-  If an error would be returned, then the function will also ASSERT().
-
   If an error is returned, then the Destination is unmodified.
 
   @param  Destination              A pointer to a Null-terminated Ascii string.
@@ -719,8 +691,6 @@ AsciiStrnCpyS (
 
   This function is similar as strcat_s defined in C11.
 
-  If an error would be returned, then the function will also ASSERT().
-
   If an error is returned, then the Destination is unmodified.
 
   @param  Destination              A pointer to a Null-terminated Ascii string.
@@ -757,8 +727,6 @@ AsciiStrCatS (
 
   This function is similar as strncat_s defined in C11.
 
-  If an error would be returned, then the function will also ASSERT().
-
   If an error is returned, then the Destination is unmodified.
 
   @param  Destination              A pointer to a Null-terminated Ascii string.
@@ -804,12 +772,6 @@ AsciiStrnCatS (
   be ignored. Then, the function stops at the first character that is a not a
   valid decimal character or a Null-terminator, whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
-  If PcdMaximumAsciiStringLength is not zero, and String contains more than
-  PcdMaximumAsciiStringLength Ascii characters, not including the
-  Null-terminator, then ASSERT().
-
   If String has no valid decimal digits in the above format, then 0 is stored
   at the location pointed to by Data.
   If the number represented by String exceeds the range defined by UINTN, then
@@ -859,12 +821,6 @@ AsciiStrDecimalToUintnS (
   be ignored. Then, the function stops at the first character that is a not a
   valid decimal character or a Null-terminator, whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
-  If PcdMaximumAsciiStringLength is not zero, and String contains more than
-  PcdMaximumAsciiStringLength Ascii characters, not including the
-  Null-terminator, then ASSERT().
-
   If String has no valid decimal digits in the above format, then 0 is stored
   at the location pointed to by Data.
   If the number represented by String exceeds the range defined by UINT64, then
@@ -918,12 +874,6 @@ AsciiStrDecimalToUint64S (
   character that is a not a valid hexadecimal character or Null-terminator,
   whichever on comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
-  If PcdMaximumAsciiStringLength is not zero, and String contains more than
-  PcdMaximumAsciiStringLength Ascii characters, not including the
-  Null-terminator, then ASSERT().
-
   If String has no valid hexadecimal digits in the above format, then 0 is
   stored at the location pointed to by Data.
   If the number represented by String exceeds the range defined by UINTN, then
@@ -977,12 +927,6 @@ AsciiStrHexToUintnS (
   character that is a not a valid hexadecimal character or Null-terminator,
   whichever on comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
-  If PcdMaximumAsciiStringLength is not zero, and String contains more than
-  PcdMaximumAsciiStringLength Ascii characters, not including the
-  Null-terminator, then ASSERT().
-
   If String has no valid hexadecimal digits in the above format, then 0 is
   stored at the location pointed to by Data.
   If the number represented by String exceeds the range defined by UINT64, then
@@ -1533,16 +1477,8 @@ StrHexToUint64 (
   "::" can be used to compress one or more groups of X when X contains only 0.
   The "::" can only appear once in the String.
 
-  If String is NULL, then ASSERT().
-
-  If Address is NULL, then ASSERT().
-
   If String is not aligned in a 16-bit boundary, then ASSERT().
 
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
-
   If EndPointer is not NULL and Address is translated from String, a pointer
   to the character that stopped the scan is stored at the location pointed to
   by EndPointer.
@@ -1594,16 +1530,8 @@ StrToIpv6Address (
   When /P is in the String, the function stops at the first character that is not
   a valid decimal digit character after P is converted.
 
-  If String is NULL, then ASSERT().
-
-  If Address is NULL, then ASSERT().
-
   If String is not aligned in a 16-bit boundary, then ASSERT().
 
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
-
   If EndPointer is not NULL and Address is translated from String, a pointer
   to the character that stopped the scan is stored at the location pointed to
   by EndPointer.
@@ -1667,8 +1595,6 @@ StrToIpv4Address (
                   oo          Data4[48:55]
                   pp          Data4[56:63]
 
-  If String is NULL, then ASSERT().
-  If Guid is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
 
   @param  String                   Pointer to a Null-terminated Unicode string.
@@ -1703,17 +1629,6 @@ StrToGuid (
 
   If String is not aligned in a 16-bit boundary, then ASSERT().
 
-  If String is NULL, then ASSERT().
-
-  If Buffer is NULL, then ASSERT().
-
-  If Length is not multiple of 2, then ASSERT().
-
-  If PcdMaximumUnicodeStringLength is not zero and Length is greater than
-  PcdMaximumUnicodeStringLength, then ASSERT().
-
-  If MaxBufferSize is less than (Length / 2), then ASSERT().
-
   @param  String                   Pointer to a Null-terminated Unicode string.
   @param  Length                   The number of Unicode characters to decode.
   @param  Buffer                   Pointer to the converted bytes array.
@@ -1804,7 +1719,6 @@ UnicodeStrToAsciiStr (
   the upper 8 bits, then ASSERT().
 
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -1851,7 +1765,6 @@ UnicodeStrToAsciiStrS (
   If any Unicode characters in Source contain non-zero value in the upper 8
   bits, then ASSERT().
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -2415,10 +2328,6 @@ AsciiStrHexToUint64 (
   "::" can be used to compress one or more groups of X when X contains only 0.
   The "::" can only appear once in the String.
 
-  If String is NULL, then ASSERT().
-
-  If Address is NULL, then ASSERT().
-
   If EndPointer is not NULL and Address is translated from String, a pointer
   to the character that stopped the scan is stored at the location pointed to
   by EndPointer.
@@ -2470,10 +2379,6 @@ AsciiStrToIpv6Address (
   When /P is in the String, the function stops at the first character that is not
   a valid decimal digit character after P is converted.
 
-  If String is NULL, then ASSERT().
-
-  If Address is NULL, then ASSERT().
-
   If EndPointer is not NULL and Address is translated from String, a pointer
   to the character that stopped the scan is stored at the location pointed to
   by EndPointer.
@@ -2535,9 +2440,6 @@ AsciiStrToIpv4Address (
                   oo          Data4[48:55]
                   pp          Data4[56:63]
 
-  If String is NULL, then ASSERT().
-  If Guid is NULL, then ASSERT().
-
   @param  String                   Pointer to a Null-terminated ASCII string.
   @param  Guid                     Pointer to the converted GUID.
 
@@ -2568,17 +2470,6 @@ AsciiStrToGuid (
   decoding stops after Length of characters and outputs Buffer containing
   (Length / 2) bytes.
 
-  If String is NULL, then ASSERT().
-
-  If Buffer is NULL, then ASSERT().
-
-  If Length is not multiple of 2, then ASSERT().
-
-  If PcdMaximumAsciiStringLength is not zero and Length is greater than
-  PcdMaximumAsciiStringLength, then ASSERT().
-
-  If MaxBufferSize is less than (Length / 2), then ASSERT().
-
   @param  String                   Pointer to a Null-terminated ASCII string.
   @param  Length                   The number of ASCII characters to decode.
   @param  Buffer                   Pointer to the converted bytes array.
@@ -2659,7 +2550,6 @@ AsciiStrToUnicodeStr (
   equal or greater than ((AsciiStrLen (Source) + 1) * sizeof (CHAR16)) in bytes.
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -2705,7 +2595,6 @@ AsciiStrToUnicodeStrS (
   ((MIN(AsciiStrLen(Source), Length) + 1) * sizeof (CHAR8)) in bytes.
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then Destination and DestinationLength are
   unmodified.
diff --git a/MdePkg/Library/BaseLib/SafeString.c b/MdePkg/Library/BaseLib/SafeString.c
index 7dc03d2caa..3bb23ca1a1 100644
--- a/MdePkg/Library/BaseLib/SafeString.c
+++ b/MdePkg/Library/BaseLib/SafeString.c
@@ -14,8 +14,10 @@
 
 #define SAFE_STRING_CONSTRAINT_CHECK(Expression, Status)  \
   do { \
-    ASSERT (Expression); \
     if (!(Expression)) { \
+      DEBUG ((DEBUG_VERBOSE, \
+        "%a(%d) %a: SAFE_STRING_CONSTRAINT_CHECK(%a) failed.  Return %r\n", \
+        __FILE__, __LINE__, __FUNCTION__, #Expression, Status)); \
       return Status; \
     } \
   } while (FALSE)
@@ -197,7 +199,6 @@ StrnSizeS (
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -279,7 +280,6 @@ StrCpyS (
 
   If Length > 0 and Destination is not aligned on a 16-bit boundary, then ASSERT().
   If Length > 0 and Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -372,7 +372,6 @@ StrnCpyS (
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -473,7 +472,6 @@ StrCatS (
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -590,12 +588,7 @@ StrnCatS (
   be ignored. Then, the function stops at the first character that is a not a
   valid decimal character or a Null-terminator, whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
 
   If String has no valid decimal digits in the above format, then 0 is stored
   at the location pointed to by Data.
@@ -705,12 +698,7 @@ StrDecimalToUintnS (
   be ignored. Then, the function stops at the first character that is a not a
   valid decimal character or a Null-terminator, whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
 
   If String has no valid decimal digits in the above format, then 0 is stored
   at the location pointed to by Data.
@@ -825,12 +813,7 @@ StrDecimalToUint64S (
   the first character that is a not a valid hexadecimal character or NULL,
   whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
 
   If String has no valid hexadecimal digits in the above format, then 0 is
   stored at the location pointed to by Data.
@@ -956,12 +939,7 @@ StrHexToUintnS (
   the first character that is a not a valid hexadecimal character or NULL,
   whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
 
   If String has no valid hexadecimal digits in the above format, then 0 is
   stored at the location pointed to by Data.
@@ -1091,16 +1069,8 @@ StrHexToUint64S (
   "::" can be used to compress one or more groups of X when X contains only 0.
   The "::" can only appear once in the String.
 
-  If String is NULL, then ASSERT().
-
-  If Address is NULL, then ASSERT().
-
   If String is not aligned in a 16-bit boundary, then ASSERT().
 
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
-
   If EndPointer is not NULL and Address is translated from String, a pointer
   to the character that stopped the scan is stored at the location pointed to
   by EndPointer.
@@ -1317,16 +1287,8 @@ StrToIpv6Address (
   When /P is in the String, the function stops at the first character that is not
   a valid decimal digit character after P is converted.
 
-  If String is NULL, then ASSERT().
-
-  If Address is NULL, then ASSERT().
-
   If String is not aligned in a 16-bit boundary, then ASSERT().
 
-  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
-  PcdMaximumUnicodeStringLength Unicode characters, not including the
-  Null-terminator, then ASSERT().
-
   If EndPointer is not NULL and Address is translated from String, a pointer
   to the character that stopped the scan is stored at the location pointed to
   by EndPointer.
@@ -1482,8 +1444,6 @@ StrToIpv4Address (
                   oo          Data4[48:55]
                   pp          Data4[56:63]
 
-  If String is NULL, then ASSERT().
-  If Guid is NULL, then ASSERT().
   If String is not aligned in a 16-bit boundary, then ASSERT().
 
   @param  String                   Pointer to a Null-terminated Unicode string.
@@ -1589,17 +1549,6 @@ StrToGuid (
 
   If String is not aligned in a 16-bit boundary, then ASSERT().
 
-  If String is NULL, then ASSERT().
-
-  If Buffer is NULL, then ASSERT().
-
-  If Length is not multiple of 2, then ASSERT().
-
-  If PcdMaximumUnicodeStringLength is not zero and Length is greater than
-  PcdMaximumUnicodeStringLength, then ASSERT().
-
-  If MaxBufferSize is less than (Length / 2), then ASSERT().
-
   @param  String                   Pointer to a Null-terminated Unicode string.
   @param  Length                   The number of Unicode characters to decode.
   @param  Buffer                   Pointer to the converted bytes array.
@@ -1779,8 +1728,6 @@ AsciiStrnSizeS (
 
   This function is similar as strcpy_s defined in C11.
 
-  If an error would be returned, then the function will also ASSERT().
-
   If an error is returned, then the Destination is unmodified.
 
   @param  Destination              A pointer to a Null-terminated Ascii string.
@@ -1856,8 +1803,6 @@ AsciiStrCpyS (
 
   This function is similar as strncpy_s defined in C11.
 
-  If an error would be returned, then the function will also ASSERT().
-
   If an error is returned, then the Destination is unmodified.
 
   @param  Destination              A pointer to a Null-terminated Ascii string.
@@ -1944,8 +1889,6 @@ AsciiStrnCpyS (
 
   This function is similar as strcat_s defined in C11.
 
-  If an error would be returned, then the function will also ASSERT().
-
   If an error is returned, then the Destination is unmodified.
 
   @param  Destination              A pointer to a Null-terminated Ascii string.
@@ -2040,8 +1983,6 @@ AsciiStrCatS (
 
   This function is similar as strncat_s defined in C11.
 
-  If an error would be returned, then the function will also ASSERT().
-
   If an error is returned, then the Destination is unmodified.
 
   @param  Destination              A pointer to a Null-terminated Ascii string.
@@ -2154,12 +2095,6 @@ AsciiStrnCatS (
   be ignored. Then, the function stops at the first character that is a not a
   valid decimal character or a Null-terminator, whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
-  If PcdMaximumAsciiStringLength is not zero, and String contains more than
-  PcdMaximumAsciiStringLength Ascii characters, not including the
-  Null-terminator, then ASSERT().
-
   If String has no valid decimal digits in the above format, then 0 is stored
   at the location pointed to by Data.
   If the number represented by String exceeds the range defined by UINTN, then
@@ -2266,12 +2201,6 @@ AsciiStrDecimalToUintnS (
   be ignored. Then, the function stops at the first character that is a not a
   valid decimal character or a Null-terminator, whichever one comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
-  If PcdMaximumAsciiStringLength is not zero, and String contains more than
-  PcdMaximumAsciiStringLength Ascii characters, not including the
-  Null-terminator, then ASSERT().
-
   If String has no valid decimal digits in the above format, then 0 is stored
   at the location pointed to by Data.
   If the number represented by String exceeds the range defined by UINT64, then
@@ -2382,12 +2311,6 @@ AsciiStrDecimalToUint64S (
   character that is a not a valid hexadecimal character or Null-terminator,
   whichever on comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
-  If PcdMaximumAsciiStringLength is not zero, and String contains more than
-  PcdMaximumAsciiStringLength Ascii characters, not including the
-  Null-terminator, then ASSERT().
-
   If String has no valid hexadecimal digits in the above format, then 0 is
   stored at the location pointed to by Data.
   If the number represented by String exceeds the range defined by UINTN, then
@@ -2509,12 +2432,6 @@ AsciiStrHexToUintnS (
   character that is a not a valid hexadecimal character or Null-terminator,
   whichever on comes first.
 
-  If String is NULL, then ASSERT().
-  If Data is NULL, then ASSERT().
-  If PcdMaximumAsciiStringLength is not zero, and String contains more than
-  PcdMaximumAsciiStringLength Ascii characters, not including the
-  Null-terminator, then ASSERT().
-
   If String has no valid hexadecimal digits in the above format, then 0 is
   stored at the location pointed to by Data.
   If the number represented by String exceeds the range defined by UINT64, then
@@ -2635,7 +2552,6 @@ AsciiStrHexToUint64S (
   the upper 8 bits, then ASSERT().
 
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -2735,7 +2651,6 @@ UnicodeStrToAsciiStrS (
   If any Unicode characters in Source contain non-zero value in the upper 8
   bits, then ASSERT().
   If Source is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then Destination and DestinationLength are
   unmodified.
@@ -2855,7 +2770,6 @@ UnicodeStrnToAsciiStrS (
   equal or greater than ((AsciiStrLen (Source) + 1) * sizeof (CHAR16)) in bytes.
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then the Destination is unmodified.
 
@@ -2948,7 +2862,6 @@ AsciiStrToUnicodeStrS (
   ((MIN(AsciiStrLen(Source), Length) + 1) * sizeof (CHAR8)) in bytes.
 
   If Destination is not aligned on a 16-bit boundary, then ASSERT().
-  If an error would be returned, then the function will also ASSERT().
 
   If an error is returned, then Destination and DestinationLength are
   unmodified.
@@ -3072,10 +2985,6 @@ AsciiStrnToUnicodeStrS (
   "::" can be used to compress one or more groups of X when X contains only 0.
   The "::" can only appear once in the String.
 
-  If String is NULL, then ASSERT().
-
-  If Address is NULL, then ASSERT().
-
   If EndPointer is not NULL and Address is translated from String, a pointer
   to the character that stopped the scan is stored at the location pointed to
   by EndPointer.
@@ -3291,10 +3200,6 @@ AsciiStrToIpv6Address (
   When /P is in the String, the function stops at the first character that is not
   a valid decimal digit character after P is converted.
 
-  If String is NULL, then ASSERT().
-
-  If Address is NULL, then ASSERT().
-
   If EndPointer is not NULL and Address is translated from String, a pointer
   to the character that stopped the scan is stored at the location pointed to
   by EndPointer.
@@ -3448,9 +3353,6 @@ AsciiStrToIpv4Address (
                   oo          Data4[48:55]
                   pp          Data4[56:63]
 
-  If String is NULL, then ASSERT().
-  If Guid is NULL, then ASSERT().
-
   @param  String                   Pointer to a Null-terminated ASCII string.
   @param  Guid                     Pointer to the converted GUID.
 
@@ -3550,17 +3452,6 @@ AsciiStrToGuid (
   decoding stops after Length of characters and outputs Buffer containing
   (Length / 2) bytes.
 
-  If String is NULL, then ASSERT().
-
-  If Buffer is NULL, then ASSERT().
-
-  If Length is not multiple of 2, then ASSERT().
-
-  If PcdMaximumAsciiStringLength is not zero and Length is greater than
-  PcdMaximumAsciiStringLength, then ASSERT().
-
-  If MaxBufferSize is less than (Length / 2), then ASSERT().
-
   @param  String                   Pointer to a Null-terminated ASCII string.
   @param  Length                   The number of ASCII characters to decode.
   @param  Buffer                   Pointer to the converted bytes array.
-- 
2.21.0.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#59912): https://edk2.groups.io/g/devel/message/59912
Mute This Topic: https://groups.io/mt/74341929/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [Patch v8 1/2] MdePkg: Fix SafeString performing assertions on runtime checks
Posted by Vitaly Cheptsov via groups.io 5 years, 8 months ago 
Mike,

Looks perfect to me. For everyone: the only change from V7 is an addition of DEBUG_VERBOSE message, which can indeed be useful.

Best wishes,
Vitaly

> 20 мая 2020 г., в 06:01, Michael D Kinney <michael.d.kinney@intel.com> написал(а):
> 
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2054
> 
> Runtime checks returned via status return code should not work as
> assertions to permit parsing not trusted data with SafeString
> interfaces.  Replace ASSERT() with a DEBUG_VERBOSE message.
> 
> Cc: Andrew Fish <afish@apple.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Bret Barkelew <bret.barkelew@microsoft.com>
> Cc: Brian J. Johnson <brian.johnson@hpe.com>
> Cc: Chasel Chiu <chasel.chiu@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Leif Lindholm <leif@nuviainc.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Marvin H?user <mhaeuser@outlook.de>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Vincent Zimmer <vincent.zimmer@intel.com>
> Cc: Zhichao Gao <zhichao.gao@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Signed-off-by: Vitaly Cheptsov <vit9696@protonmail.com>
> ---
> MdePkg/Include/Library/BaseLib.h    | 111 ---------------------------
> MdePkg/Library/BaseLib/SafeString.c | 115 +---------------------------
> 2 files changed, 3 insertions(+), 223 deletions(-)
> 
> diff --git a/MdePkg/Include/Library/BaseLib.h b/MdePkg/Include/Library/BaseLib.h
> index b0bbe8cef8..8e7b87cbda 100644
> --- a/MdePkg/Include/Library/BaseLib.h
> +++ b/MdePkg/Include/Library/BaseLib.h
> @@ -216,7 +216,6 @@ StrnSizeS (
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -252,7 +251,6 @@ StrCpyS (
> 
>   If Length > 0 and Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Length > 0 and Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -290,7 +288,6 @@ StrnCpyS (
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -330,7 +327,6 @@ StrCatS (
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -377,12 +373,7 @@ StrnCatS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
> @@ -433,12 +424,7 @@ StrDecimalToUintnS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
> @@ -494,12 +480,7 @@ StrDecimalToUint64S (
>   the first character that is a not a valid hexadecimal character or NULL,
>   whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
> @@ -555,12 +536,7 @@ StrHexToUintnS (
>   the first character that is a not a valid hexadecimal character or NULL,
>   whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
> @@ -649,8 +625,6 @@ AsciiStrnSizeS (
> 
>   This function is similar as strcpy_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
> 
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -683,8 +657,6 @@ AsciiStrCpyS (
> 
>   This function is similar as strncpy_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
> 
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -719,8 +691,6 @@ AsciiStrnCpyS (
> 
>   This function is similar as strcat_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
> 
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -757,8 +727,6 @@ AsciiStrCatS (
> 
>   This function is similar as strncat_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
> 
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -804,12 +772,6 @@ AsciiStrnCatS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINTN, then
> @@ -859,12 +821,6 @@ AsciiStrDecimalToUintnS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINT64, then
> @@ -918,12 +874,6 @@ AsciiStrDecimalToUint64S (
>   character that is a not a valid hexadecimal character or Null-terminator,
>   whichever on comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINTN, then
> @@ -977,12 +927,6 @@ AsciiStrHexToUintnS (
>   character that is a not a valid hexadecimal character or Null-terminator,
>   whichever on comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINT64, then
> @@ -1533,16 +1477,8 @@ StrHexToUint64 (
>   "::" can be used to compress one or more groups of X when X contains only 0.
>   The "::" can only appear once in the String.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -1594,16 +1530,8 @@ StrToIpv6Address (
>   When /P is in the String, the function stops at the first character that is not
>   a valid decimal digit character after P is converted.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -1667,8 +1595,6 @@ StrToIpv4Address (
>                   oo          Data4[48:55]
>                   pp          Data4[56:63]
> 
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> 
>   @param  String                   Pointer to a Null-terminated Unicode string.
> @@ -1703,17 +1629,6 @@ StrToGuid (
> 
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumUnicodeStringLength is not zero and Length is greater than
> -  PcdMaximumUnicodeStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated Unicode string.
>   @param  Length                   The number of Unicode characters to decode.
>   @param  Buffer                   Pointer to the converted bytes array.
> @@ -1804,7 +1719,6 @@ UnicodeStrToAsciiStr (
>   the upper 8 bits, then ASSERT().
> 
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -1851,7 +1765,6 @@ UnicodeStrToAsciiStrS (
>   If any Unicode characters in Source contain non-zero value in the upper 8
>   bits, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -2415,10 +2328,6 @@ AsciiStrHexToUint64 (
>   "::" can be used to compress one or more groups of X when X contains only 0.
>   The "::" can only appear once in the String.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -2470,10 +2379,6 @@ AsciiStrToIpv6Address (
>   When /P is in the String, the function stops at the first character that is not
>   a valid decimal digit character after P is converted.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -2535,9 +2440,6 @@ AsciiStrToIpv4Address (
>                   oo          Data4[48:55]
>                   pp          Data4[56:63]
> 
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated ASCII string.
>   @param  Guid                     Pointer to the converted GUID.
> 
> @@ -2568,17 +2470,6 @@ AsciiStrToGuid (
>   decoding stops after Length of characters and outputs Buffer containing
>   (Length / 2) bytes.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumAsciiStringLength is not zero and Length is greater than
> -  PcdMaximumAsciiStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated ASCII string.
>   @param  Length                   The number of ASCII characters to decode.
>   @param  Buffer                   Pointer to the converted bytes array.
> @@ -2659,7 +2550,6 @@ AsciiStrToUnicodeStr (
>   equal or greater than ((AsciiStrLen (Source) + 1) * sizeof (CHAR16)) in bytes.
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -2705,7 +2595,6 @@ AsciiStrToUnicodeStrS (
>   ((MIN(AsciiStrLen(Source), Length) + 1) * sizeof (CHAR8)) in bytes.
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then Destination and DestinationLength are
>   unmodified.
> diff --git a/MdePkg/Library/BaseLib/SafeString.c b/MdePkg/Library/BaseLib/SafeString.c
> index 7dc03d2caa..3bb23ca1a1 100644
> --- a/MdePkg/Library/BaseLib/SafeString.c
> +++ b/MdePkg/Library/BaseLib/SafeString.c
> @@ -14,8 +14,10 @@
> 
> #define SAFE_STRING_CONSTRAINT_CHECK(Expression, Status)  \
>   do { \
> -    ASSERT (Expression); \
>     if (!(Expression)) { \
> +      DEBUG ((DEBUG_VERBOSE, \
> +        "%a(%d) %a: SAFE_STRING_CONSTRAINT_CHECK(%a) failed.  Return %r\n", \
> +        __FILE__, __LINE__, __FUNCTION__, #Expression, Status)); \
>       return Status; \
>     } \
>   } while (FALSE)
> @@ -197,7 +199,6 @@ StrnSizeS (
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -279,7 +280,6 @@ StrCpyS (
> 
>   If Length > 0 and Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Length > 0 and Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -372,7 +372,6 @@ StrnCpyS (
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -473,7 +472,6 @@ StrCatS (
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -590,12 +588,7 @@ StrnCatS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
> @@ -705,12 +698,7 @@ StrDecimalToUintnS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
> @@ -825,12 +813,7 @@ StrDecimalToUint64S (
>   the first character that is a not a valid hexadecimal character or NULL,
>   whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
> @@ -956,12 +939,7 @@ StrHexToUintnS (
>   the first character that is a not a valid hexadecimal character or NULL,
>   whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
> @@ -1091,16 +1069,8 @@ StrHexToUint64S (
>   "::" can be used to compress one or more groups of X when X contains only 0.
>   The "::" can only appear once in the String.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -1317,16 +1287,8 @@ StrToIpv6Address (
>   When /P is in the String, the function stops at the first character that is not
>   a valid decimal digit character after P is converted.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -1482,8 +1444,6 @@ StrToIpv4Address (
>                   oo          Data4[48:55]
>                   pp          Data4[56:63]
> 
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> 
>   @param  String                   Pointer to a Null-terminated Unicode string.
> @@ -1589,17 +1549,6 @@ StrToGuid (
> 
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumUnicodeStringLength is not zero and Length is greater than
> -  PcdMaximumUnicodeStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated Unicode string.
>   @param  Length                   The number of Unicode characters to decode.
>   @param  Buffer                   Pointer to the converted bytes array.
> @@ -1779,8 +1728,6 @@ AsciiStrnSizeS (
> 
>   This function is similar as strcpy_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
> 
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -1856,8 +1803,6 @@ AsciiStrCpyS (
> 
>   This function is similar as strncpy_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
> 
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -1944,8 +1889,6 @@ AsciiStrnCpyS (
> 
>   This function is similar as strcat_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
> 
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -2040,8 +1983,6 @@ AsciiStrCatS (
> 
>   This function is similar as strncat_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
> 
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -2154,12 +2095,6 @@ AsciiStrnCatS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINTN, then
> @@ -2266,12 +2201,6 @@ AsciiStrDecimalToUintnS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINT64, then
> @@ -2382,12 +2311,6 @@ AsciiStrDecimalToUint64S (
>   character that is a not a valid hexadecimal character or Null-terminator,
>   whichever on comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINTN, then
> @@ -2509,12 +2432,6 @@ AsciiStrHexToUintnS (
>   character that is a not a valid hexadecimal character or Null-terminator,
>   whichever on comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINT64, then
> @@ -2635,7 +2552,6 @@ AsciiStrHexToUint64S (
>   the upper 8 bits, then ASSERT().
> 
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -2735,7 +2651,6 @@ UnicodeStrToAsciiStrS (
>   If any Unicode characters in Source contain non-zero value in the upper 8
>   bits, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then Destination and DestinationLength are
>   unmodified.
> @@ -2855,7 +2770,6 @@ UnicodeStrnToAsciiStrS (
>   equal or greater than ((AsciiStrLen (Source) + 1) * sizeof (CHAR16)) in bytes.
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then the Destination is unmodified.
> 
> @@ -2948,7 +2862,6 @@ AsciiStrToUnicodeStrS (
>   ((MIN(AsciiStrLen(Source), Length) + 1) * sizeof (CHAR8)) in bytes.
> 
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>   If an error is returned, then Destination and DestinationLength are
>   unmodified.
> @@ -3072,10 +2985,6 @@ AsciiStrnToUnicodeStrS (
>   "::" can be used to compress one or more groups of X when X contains only 0.
>   The "::" can only appear once in the String.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -3291,10 +3200,6 @@ AsciiStrToIpv6Address (
>   When /P is in the String, the function stops at the first character that is not
>   a valid decimal digit character after P is converted.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -3448,9 +3353,6 @@ AsciiStrToIpv4Address (
>                   oo          Data4[48:55]
>                   pp          Data4[56:63]
> 
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated ASCII string.
>   @param  Guid                     Pointer to the converted GUID.
> 
> @@ -3550,17 +3452,6 @@ AsciiStrToGuid (
>   decoding stops after Length of characters and outputs Buffer containing
>   (Length / 2) bytes.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumAsciiStringLength is not zero and Length is greater than
> -  PcdMaximumAsciiStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated ASCII string.
>   @param  Length                   The number of ASCII characters to decode.
>   @param  Buffer                   Pointer to the converted bytes array.
> --
> 2.21.0.windows.1
> 


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#59938): https://edk2.groups.io/g/devel/message/59938
Mute This Topic: https://groups.io/mt/74341929/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [EXTERNAL] Re: [edk2-devel] [Patch v8 1/2] MdePkg: Fix SafeString performing assertions on runtime checks
Posted by Bret Barkelew via groups.io 5 years, 8 months ago 
Reviewed-by: Bret Barkelew <bret.barkelew@microsoft.com>

- Bret

From: Vitaly Cheptsov via groups.io<mailto:vit9696=protonmail.com@groups.io>
Sent: Tuesday, May 19, 2020 10:56 PM
To: Kinney, Michael D<mailto:michael.d.kinney@intel.com>; Laszlo Ersek<mailto:lersek@redhat.com>
Cc: devel@edk2.groups.io<mailto:devel@edk2.groups.io>; Andrew Fish<mailto:afish@apple.com>; Ard Biesheuvel<mailto:ard.biesheuvel@linaro.org>; Bret Barkelew<mailto:Bret.Barkelew@microsoft.com>; Brian J . Johnson<mailto:brian.johnson@hpe.com>; Chasel Chiu<mailto:chasel.chiu@intel.com>; Jordan Justen<mailto:jordan.l.justen@intel.com>; Leif Lindholm<mailto:leif@nuviainc.com>; liming.gao<mailto:liming.gao@intel.com>; Marvin H?user<mailto:mhaeuser@outlook.de>; Zimmer, Vincent<mailto:vincent.zimmer@intel.com>; Zhichao Gao<mailto:zhichao.gao@intel.com>; Yao, Jiewen<mailto:jiewen.yao@intel.com>
Subject: [EXTERNAL] Re: [edk2-devel] [Patch v8 1/2] MdePkg: Fix SafeString performing assertions on runtime checks

Mike,

Looks perfect to me. For everyone: the only change from V7 is an addition of DEBUG_VERBOSE message, which can indeed be useful.

Best wishes,
Vitaly

> 20 мая 2020 г., в 06:01, Michael D Kinney <michael.d.kinney@intel.com> написал(а):
>
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2054
>
> Runtime checks returned via status return code should not work as
> assertions to permit parsing not trusted data with SafeString
> interfaces.  Replace ASSERT() with a DEBUG_VERBOSE message.
>
> Cc: Andrew Fish <afish@apple.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Bret Barkelew <bret.barkelew@microsoft.com>
> Cc: Brian J. Johnson <brian.johnson@hpe.com>
> Cc: Chasel Chiu <chasel.chiu@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Leif Lindholm <leif@nuviainc.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Marvin H?user <mhaeuser@outlook.de>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Vincent Zimmer <vincent.zimmer@intel.com>
> Cc: Zhichao Gao <zhichao.gao@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Signed-off-by: Vitaly Cheptsov <vit9696@protonmail.com>
> ---
> MdePkg/Include/Library/BaseLib.h    | 111 ---------------------------
> MdePkg/Library/BaseLib/SafeString.c | 115 +---------------------------
> 2 files changed, 3 insertions(+), 223 deletions(-)
>
> diff --git a/MdePkg/Include/Library/BaseLib.h b/MdePkg/Include/Library/BaseLib.h
> index b0bbe8cef8..8e7b87cbda 100644
> --- a/MdePkg/Include/Library/BaseLib.h
> +++ b/MdePkg/Include/Library/BaseLib.h
> @@ -216,7 +216,6 @@ StrnSizeS (
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -252,7 +251,6 @@ StrCpyS (
>
>   If Length > 0 and Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Length > 0 and Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -290,7 +288,6 @@ StrnCpyS (
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -330,7 +327,6 @@ StrCatS (
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -377,12 +373,7 @@ StrnCatS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
>
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
> @@ -433,12 +424,7 @@ StrDecimalToUintnS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
>
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
> @@ -494,12 +480,7 @@ StrDecimalToUint64S (
>   the first character that is a not a valid hexadecimal character or NULL,
>   whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
>
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
> @@ -555,12 +536,7 @@ StrHexToUintnS (
>   the first character that is a not a valid hexadecimal character or NULL,
>   whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
>
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
> @@ -649,8 +625,6 @@ AsciiStrnSizeS (
>
>   This function is similar as strcpy_s defined in C11.
>
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
>
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -683,8 +657,6 @@ AsciiStrCpyS (
>
>   This function is similar as strncpy_s defined in C11.
>
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
>
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -719,8 +691,6 @@ AsciiStrnCpyS (
>
>   This function is similar as strcat_s defined in C11.
>
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
>
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -757,8 +727,6 @@ AsciiStrCatS (
>
>   This function is similar as strncat_s defined in C11.
>
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
>
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -804,12 +772,6 @@ AsciiStrnCatS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINTN, then
> @@ -859,12 +821,6 @@ AsciiStrDecimalToUintnS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINT64, then
> @@ -918,12 +874,6 @@ AsciiStrDecimalToUint64S (
>   character that is a not a valid hexadecimal character or Null-terminator,
>   whichever on comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINTN, then
> @@ -977,12 +927,6 @@ AsciiStrHexToUintnS (
>   character that is a not a valid hexadecimal character or Null-terminator,
>   whichever on comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINT64, then
> @@ -1533,16 +1477,8 @@ StrHexToUint64 (
>   "::" can be used to compress one or more groups of X when X contains only 0.
>   The "::" can only appear once in the String.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If String is not aligned in a 16-bit boundary, then ASSERT().
>
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -1594,16 +1530,8 @@ StrToIpv6Address (
>   When /P is in the String, the function stops at the first character that is not
>   a valid decimal digit character after P is converted.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If String is not aligned in a 16-bit boundary, then ASSERT().
>
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -1667,8 +1595,6 @@ StrToIpv4Address (
>                   oo          Data4[48:55]
>                   pp          Data4[56:63]
>
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
>
>   @param  String                   Pointer to a Null-terminated Unicode string.
> @@ -1703,17 +1629,6 @@ StrToGuid (
>
>   If String is not aligned in a 16-bit boundary, then ASSERT().
>
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumUnicodeStringLength is not zero and Length is greater than
> -  PcdMaximumUnicodeStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated Unicode string.
>   @param  Length                   The number of Unicode characters to decode.
>   @param  Buffer                   Pointer to the converted bytes array.
> @@ -1804,7 +1719,6 @@ UnicodeStrToAsciiStr (
>   the upper 8 bits, then ASSERT().
>
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -1851,7 +1765,6 @@ UnicodeStrToAsciiStrS (
>   If any Unicode characters in Source contain non-zero value in the upper 8
>   bits, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -2415,10 +2328,6 @@ AsciiStrHexToUint64 (
>   "::" can be used to compress one or more groups of X when X contains only 0.
>   The "::" can only appear once in the String.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -2470,10 +2379,6 @@ AsciiStrToIpv6Address (
>   When /P is in the String, the function stops at the first character that is not
>   a valid decimal digit character after P is converted.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -2535,9 +2440,6 @@ AsciiStrToIpv4Address (
>                   oo          Data4[48:55]
>                   pp          Data4[56:63]
>
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated ASCII string.
>   @param  Guid                     Pointer to the converted GUID.
>
> @@ -2568,17 +2470,6 @@ AsciiStrToGuid (
>   decoding stops after Length of characters and outputs Buffer containing
>   (Length / 2) bytes.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumAsciiStringLength is not zero and Length is greater than
> -  PcdMaximumAsciiStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated ASCII string.
>   @param  Length                   The number of ASCII characters to decode.
>   @param  Buffer                   Pointer to the converted bytes array.
> @@ -2659,7 +2550,6 @@ AsciiStrToUnicodeStr (
>   equal or greater than ((AsciiStrLen (Source) + 1) * sizeof (CHAR16)) in bytes.
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -2705,7 +2595,6 @@ AsciiStrToUnicodeStrS (
>   ((MIN(AsciiStrLen(Source), Length) + 1) * sizeof (CHAR8)) in bytes.
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then Destination and DestinationLength are
>   unmodified.
> diff --git a/MdePkg/Library/BaseLib/SafeString.c b/MdePkg/Library/BaseLib/SafeString.c
> index 7dc03d2caa..3bb23ca1a1 100644
> --- a/MdePkg/Library/BaseLib/SafeString.c
> +++ b/MdePkg/Library/BaseLib/SafeString.c
> @@ -14,8 +14,10 @@
>
> #define SAFE_STRING_CONSTRAINT_CHECK(Expression, Status)  \
>   do { \
> -    ASSERT (Expression); \
>     if (!(Expression)) { \
> +      DEBUG ((DEBUG_VERBOSE, \
> +        "%a(%d) %a: SAFE_STRING_CONSTRAINT_CHECK(%a) failed.  Return %r\n", \
> +        __FILE__, __LINE__, __FUNCTION__, #Expression, Status)); \
>       return Status; \
>     } \
>   } while (FALSE)
> @@ -197,7 +199,6 @@ StrnSizeS (
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -279,7 +280,6 @@ StrCpyS (
>
>   If Length > 0 and Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Length > 0 and Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -372,7 +372,6 @@ StrnCpyS (
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -473,7 +472,6 @@ StrCatS (
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -590,12 +588,7 @@ StrnCatS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
>
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
> @@ -705,12 +698,7 @@ StrDecimalToUintnS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
>
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
> @@ -825,12 +813,7 @@ StrDecimalToUint64S (
>   the first character that is a not a valid hexadecimal character or NULL,
>   whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
>
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
> @@ -956,12 +939,7 @@ StrHexToUintnS (
>   the first character that is a not a valid hexadecimal character or NULL,
>   whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
>
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
> @@ -1091,16 +1069,8 @@ StrHexToUint64S (
>   "::" can be used to compress one or more groups of X when X contains only 0.
>   The "::" can only appear once in the String.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If String is not aligned in a 16-bit boundary, then ASSERT().
>
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -1317,16 +1287,8 @@ StrToIpv6Address (
>   When /P is in the String, the function stops at the first character that is not
>   a valid decimal digit character after P is converted.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If String is not aligned in a 16-bit boundary, then ASSERT().
>
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -1482,8 +1444,6 @@ StrToIpv4Address (
>                   oo          Data4[48:55]
>                   pp          Data4[56:63]
>
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
>   If String is not aligned in a 16-bit boundary, then ASSERT().
>
>   @param  String                   Pointer to a Null-terminated Unicode string.
> @@ -1589,17 +1549,6 @@ StrToGuid (
>
>   If String is not aligned in a 16-bit boundary, then ASSERT().
>
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumUnicodeStringLength is not zero and Length is greater than
> -  PcdMaximumUnicodeStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated Unicode string.
>   @param  Length                   The number of Unicode characters to decode.
>   @param  Buffer                   Pointer to the converted bytes array.
> @@ -1779,8 +1728,6 @@ AsciiStrnSizeS (
>
>   This function is similar as strcpy_s defined in C11.
>
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
>
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -1856,8 +1803,6 @@ AsciiStrCpyS (
>
>   This function is similar as strncpy_s defined in C11.
>
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
>
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -1944,8 +1889,6 @@ AsciiStrnCpyS (
>
>   This function is similar as strcat_s defined in C11.
>
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
>
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -2040,8 +1983,6 @@ AsciiStrCatS (
>
>   This function is similar as strncat_s defined in C11.
>
> -  If an error would be returned, then the function will also ASSERT().
> -
>   If an error is returned, then the Destination is unmodified.
>
>   @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -2154,12 +2095,6 @@ AsciiStrnCatS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINTN, then
> @@ -2266,12 +2201,6 @@ AsciiStrDecimalToUintnS (
>   be ignored. Then, the function stops at the first character that is a not a
>   valid decimal character or a Null-terminator, whichever one comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid decimal digits in the above format, then 0 is stored
>   at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINT64, then
> @@ -2382,12 +2311,6 @@ AsciiStrDecimalToUint64S (
>   character that is a not a valid hexadecimal character or Null-terminator,
>   whichever on comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINTN, then
> @@ -2509,12 +2432,6 @@ AsciiStrHexToUintnS (
>   character that is a not a valid hexadecimal character or Null-terminator,
>   whichever on comes first.
>
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>   If String has no valid hexadecimal digits in the above format, then 0 is
>   stored at the location pointed to by Data.
>   If the number represented by String exceeds the range defined by UINT64, then
> @@ -2635,7 +2552,6 @@ AsciiStrHexToUint64S (
>   the upper 8 bits, then ASSERT().
>
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -2735,7 +2651,6 @@ UnicodeStrToAsciiStrS (
>   If any Unicode characters in Source contain non-zero value in the upper 8
>   bits, then ASSERT().
>   If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then Destination and DestinationLength are
>   unmodified.
> @@ -2855,7 +2770,6 @@ UnicodeStrnToAsciiStrS (
>   equal or greater than ((AsciiStrLen (Source) + 1) * sizeof (CHAR16)) in bytes.
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then the Destination is unmodified.
>
> @@ -2948,7 +2862,6 @@ AsciiStrToUnicodeStrS (
>   ((MIN(AsciiStrLen(Source), Length) + 1) * sizeof (CHAR8)) in bytes.
>
>   If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
>
>   If an error is returned, then Destination and DestinationLength are
>   unmodified.
> @@ -3072,10 +2985,6 @@ AsciiStrnToUnicodeStrS (
>   "::" can be used to compress one or more groups of X when X contains only 0.
>   The "::" can only appear once in the String.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -3291,10 +3200,6 @@ AsciiStrToIpv6Address (
>   When /P is in the String, the function stops at the first character that is not
>   a valid decimal digit character after P is converted.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>   If EndPointer is not NULL and Address is translated from String, a pointer
>   to the character that stopped the scan is stored at the location pointed to
>   by EndPointer.
> @@ -3448,9 +3353,6 @@ AsciiStrToIpv4Address (
>                   oo          Data4[48:55]
>                   pp          Data4[56:63]
>
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated ASCII string.
>   @param  Guid                     Pointer to the converted GUID.
>
> @@ -3550,17 +3452,6 @@ AsciiStrToGuid (
>   decoding stops after Length of characters and outputs Buffer containing
>   (Length / 2) bytes.
>
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumAsciiStringLength is not zero and Length is greater than
> -  PcdMaximumAsciiStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>   @param  String                   Pointer to a Null-terminated ASCII string.
>   @param  Length                   The number of ASCII characters to decode.
>   @param  Buffer                   Pointer to the converted bytes array.
> --
> 2.21.0.windows.1
>






-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#59984): https://edk2.groups.io/g/devel/message/59984
Mute This Topic: https://groups.io/mt/74355542/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [Patch v8 1/2] MdePkg: Fix SafeString performing assertions on runtime checks
Posted by Liming Gao 5 years, 8 months ago 
Reviewed-by: Liming Gao <liming.gao@intel.com>

> -----Original Message-----
> From: Kinney, Michael D <michael.d.kinney@intel.com>
> Sent: Wednesday, May 20, 2020 11:01 AM
> To: devel@edk2.groups.io
> Cc: Andrew Fish <afish@apple.com>; Ard Biesheuvel <ard.biesheuvel@linaro.org>; Bret Barkelew <bret.barkelew@microsoft.com>;
> Brian J . Johnson <brian.johnson@hpe.com>; Chiu, Chasel <chasel.chiu@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>;
> Laszlo Ersek <lersek@redhat.com>; Leif Lindholm <leif@nuviainc.com>; Gao, Liming <liming.gao@intel.com>; Marvin H?user
> <mhaeuser@outlook.de>; Zimmer, Vincent <vincent.zimmer@intel.com>; Gao, Zhichao <zhichao.gao@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>; Vitaly Cheptsov <vit9696@protonmail.com>
> Subject: [Patch v8 1/2] MdePkg: Fix SafeString performing assertions on runtime checks
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2054
> 
> Runtime checks returned via status return code should not work as
> assertions to permit parsing not trusted data with SafeString
> interfaces.  Replace ASSERT() with a DEBUG_VERBOSE message.
> 
> Cc: Andrew Fish <afish@apple.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Bret Barkelew <bret.barkelew@microsoft.com>
> Cc: Brian J. Johnson <brian.johnson@hpe.com>
> Cc: Chasel Chiu <chasel.chiu@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Leif Lindholm <leif@nuviainc.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Marvin H?user <mhaeuser@outlook.de>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Vincent Zimmer <vincent.zimmer@intel.com>
> Cc: Zhichao Gao <zhichao.gao@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Signed-off-by: Vitaly Cheptsov <vit9696@protonmail.com>
> ---
>  MdePkg/Include/Library/BaseLib.h    | 111 ---------------------------
>  MdePkg/Library/BaseLib/SafeString.c | 115 +---------------------------
>  2 files changed, 3 insertions(+), 223 deletions(-)
> 
> diff --git a/MdePkg/Include/Library/BaseLib.h b/MdePkg/Include/Library/BaseLib.h
> index b0bbe8cef8..8e7b87cbda 100644
> --- a/MdePkg/Include/Library/BaseLib.h
> +++ b/MdePkg/Include/Library/BaseLib.h
> @@ -216,7 +216,6 @@ StrnSizeS (
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -252,7 +251,6 @@ StrCpyS (
> 
>    If Length > 0 and Destination is not aligned on a 16-bit boundary, then ASSERT().
>    If Length > 0 and Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -290,7 +288,6 @@ StrnCpyS (
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -330,7 +327,6 @@ StrCatS (
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -377,12 +373,7 @@ StrnCatS (
>    be ignored. Then, the function stops at the first character that is a not a
>    valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>    If String has no valid decimal digits in the above format, then 0 is stored
>    at the location pointed to by Data.
> @@ -433,12 +424,7 @@ StrDecimalToUintnS (
>    be ignored. Then, the function stops at the first character that is a not a
>    valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>    If String has no valid decimal digits in the above format, then 0 is stored
>    at the location pointed to by Data.
> @@ -494,12 +480,7 @@ StrDecimalToUint64S (
>    the first character that is a not a valid hexadecimal character or NULL,
>    whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>    If String has no valid hexadecimal digits in the above format, then 0 is
>    stored at the location pointed to by Data.
> @@ -555,12 +536,7 @@ StrHexToUintnS (
>    the first character that is a not a valid hexadecimal character or NULL,
>    whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>    If String has no valid hexadecimal digits in the above format, then 0 is
>    stored at the location pointed to by Data.
> @@ -649,8 +625,6 @@ AsciiStrnSizeS (
> 
>    This function is similar as strcpy_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>    If an error is returned, then the Destination is unmodified.
> 
>    @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -683,8 +657,6 @@ AsciiStrCpyS (
> 
>    This function is similar as strncpy_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>    If an error is returned, then the Destination is unmodified.
> 
>    @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -719,8 +691,6 @@ AsciiStrnCpyS (
> 
>    This function is similar as strcat_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>    If an error is returned, then the Destination is unmodified.
> 
>    @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -757,8 +727,6 @@ AsciiStrCatS (
> 
>    This function is similar as strncat_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>    If an error is returned, then the Destination is unmodified.
> 
>    @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -804,12 +772,6 @@ AsciiStrnCatS (
>    be ignored. Then, the function stops at the first character that is a not a
>    valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If String has no valid decimal digits in the above format, then 0 is stored
>    at the location pointed to by Data.
>    If the number represented by String exceeds the range defined by UINTN, then
> @@ -859,12 +821,6 @@ AsciiStrDecimalToUintnS (
>    be ignored. Then, the function stops at the first character that is a not a
>    valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If String has no valid decimal digits in the above format, then 0 is stored
>    at the location pointed to by Data.
>    If the number represented by String exceeds the range defined by UINT64, then
> @@ -918,12 +874,6 @@ AsciiStrDecimalToUint64S (
>    character that is a not a valid hexadecimal character or Null-terminator,
>    whichever on comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If String has no valid hexadecimal digits in the above format, then 0 is
>    stored at the location pointed to by Data.
>    If the number represented by String exceeds the range defined by UINTN, then
> @@ -977,12 +927,6 @@ AsciiStrHexToUintnS (
>    character that is a not a valid hexadecimal character or Null-terminator,
>    whichever on comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If String has no valid hexadecimal digits in the above format, then 0 is
>    stored at the location pointed to by Data.
>    If the number represented by String exceeds the range defined by UINT64, then
> @@ -1533,16 +1477,8 @@ StrHexToUint64 (
>    "::" can be used to compress one or more groups of X when X contains only 0.
>    The "::" can only appear once in the String.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If EndPointer is not NULL and Address is translated from String, a pointer
>    to the character that stopped the scan is stored at the location pointed to
>    by EndPointer.
> @@ -1594,16 +1530,8 @@ StrToIpv6Address (
>    When /P is in the String, the function stops at the first character that is not
>    a valid decimal digit character after P is converted.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If EndPointer is not NULL and Address is translated from String, a pointer
>    to the character that stopped the scan is stored at the location pointed to
>    by EndPointer.
> @@ -1667,8 +1595,6 @@ StrToIpv4Address (
>                    oo          Data4[48:55]
>                    pp          Data4[56:63]
> 
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> 
>    @param  String                   Pointer to a Null-terminated Unicode string.
> @@ -1703,17 +1629,6 @@ StrToGuid (
> 
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumUnicodeStringLength is not zero and Length is greater than
> -  PcdMaximumUnicodeStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>    @param  String                   Pointer to a Null-terminated Unicode string.
>    @param  Length                   The number of Unicode characters to decode.
>    @param  Buffer                   Pointer to the converted bytes array.
> @@ -1804,7 +1719,6 @@ UnicodeStrToAsciiStr (
>    the upper 8 bits, then ASSERT().
> 
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -1851,7 +1765,6 @@ UnicodeStrToAsciiStrS (
>    If any Unicode characters in Source contain non-zero value in the upper 8
>    bits, then ASSERT().
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -2415,10 +2328,6 @@ AsciiStrHexToUint64 (
>    "::" can be used to compress one or more groups of X when X contains only 0.
>    The "::" can only appear once in the String.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>    If EndPointer is not NULL and Address is translated from String, a pointer
>    to the character that stopped the scan is stored at the location pointed to
>    by EndPointer.
> @@ -2470,10 +2379,6 @@ AsciiStrToIpv6Address (
>    When /P is in the String, the function stops at the first character that is not
>    a valid decimal digit character after P is converted.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>    If EndPointer is not NULL and Address is translated from String, a pointer
>    to the character that stopped the scan is stored at the location pointed to
>    by EndPointer.
> @@ -2535,9 +2440,6 @@ AsciiStrToIpv4Address (
>                    oo          Data4[48:55]
>                    pp          Data4[56:63]
> 
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
> -
>    @param  String                   Pointer to a Null-terminated ASCII string.
>    @param  Guid                     Pointer to the converted GUID.
> 
> @@ -2568,17 +2470,6 @@ AsciiStrToGuid (
>    decoding stops after Length of characters and outputs Buffer containing
>    (Length / 2) bytes.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumAsciiStringLength is not zero and Length is greater than
> -  PcdMaximumAsciiStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>    @param  String                   Pointer to a Null-terminated ASCII string.
>    @param  Length                   The number of ASCII characters to decode.
>    @param  Buffer                   Pointer to the converted bytes array.
> @@ -2659,7 +2550,6 @@ AsciiStrToUnicodeStr (
>    equal or greater than ((AsciiStrLen (Source) + 1) * sizeof (CHAR16)) in bytes.
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -2705,7 +2595,6 @@ AsciiStrToUnicodeStrS (
>    ((MIN(AsciiStrLen(Source), Length) + 1) * sizeof (CHAR8)) in bytes.
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then Destination and DestinationLength are
>    unmodified.
> diff --git a/MdePkg/Library/BaseLib/SafeString.c b/MdePkg/Library/BaseLib/SafeString.c
> index 7dc03d2caa..3bb23ca1a1 100644
> --- a/MdePkg/Library/BaseLib/SafeString.c
> +++ b/MdePkg/Library/BaseLib/SafeString.c
> @@ -14,8 +14,10 @@
> 
>  #define SAFE_STRING_CONSTRAINT_CHECK(Expression, Status)  \
>    do { \
> -    ASSERT (Expression); \
>      if (!(Expression)) { \
> +      DEBUG ((DEBUG_VERBOSE, \
> +        "%a(%d) %a: SAFE_STRING_CONSTRAINT_CHECK(%a) failed.  Return %r\n", \
> +        __FILE__, __LINE__, __FUNCTION__, #Expression, Status)); \
>        return Status; \
>      } \
>    } while (FALSE)
> @@ -197,7 +199,6 @@ StrnSizeS (
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -279,7 +280,6 @@ StrCpyS (
> 
>    If Length > 0 and Destination is not aligned on a 16-bit boundary, then ASSERT().
>    If Length > 0 and Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -372,7 +372,6 @@ StrnCpyS (
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -473,7 +472,6 @@ StrCatS (
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -590,12 +588,7 @@ StrnCatS (
>    be ignored. Then, the function stops at the first character that is a not a
>    valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>    If String has no valid decimal digits in the above format, then 0 is stored
>    at the location pointed to by Data.
> @@ -705,12 +698,7 @@ StrDecimalToUintnS (
>    be ignored. Then, the function stops at the first character that is a not a
>    valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>    If String has no valid decimal digits in the above format, then 0 is stored
>    at the location pointed to by Data.
> @@ -825,12 +813,7 @@ StrDecimalToUint64S (
>    the first character that is a not a valid hexadecimal character or NULL,
>    whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>    If String has no valid hexadecimal digits in the above format, then 0 is
>    stored at the location pointed to by Data.
> @@ -956,12 +939,7 @@ StrHexToUintnS (
>    the first character that is a not a valid hexadecimal character or NULL,
>    whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> 
>    If String has no valid hexadecimal digits in the above format, then 0 is
>    stored at the location pointed to by Data.
> @@ -1091,16 +1069,8 @@ StrHexToUint64S (
>    "::" can be used to compress one or more groups of X when X contains only 0.
>    The "::" can only appear once in the String.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If EndPointer is not NULL and Address is translated from String, a pointer
>    to the character that stopped the scan is stored at the location pointed to
>    by EndPointer.
> @@ -1317,16 +1287,8 @@ StrToIpv6Address (
>    When /P is in the String, the function stops at the first character that is not
>    a valid decimal digit character after P is converted.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If PcdMaximumUnicodeStringLength is not zero, and String contains more than
> -  PcdMaximumUnicodeStringLength Unicode characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If EndPointer is not NULL and Address is translated from String, a pointer
>    to the character that stopped the scan is stored at the location pointed to
>    by EndPointer.
> @@ -1482,8 +1444,6 @@ StrToIpv4Address (
>                    oo          Data4[48:55]
>                    pp          Data4[56:63]
> 
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> 
>    @param  String                   Pointer to a Null-terminated Unicode string.
> @@ -1589,17 +1549,6 @@ StrToGuid (
> 
>    If String is not aligned in a 16-bit boundary, then ASSERT().
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumUnicodeStringLength is not zero and Length is greater than
> -  PcdMaximumUnicodeStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>    @param  String                   Pointer to a Null-terminated Unicode string.
>    @param  Length                   The number of Unicode characters to decode.
>    @param  Buffer                   Pointer to the converted bytes array.
> @@ -1779,8 +1728,6 @@ AsciiStrnSizeS (
> 
>    This function is similar as strcpy_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>    If an error is returned, then the Destination is unmodified.
> 
>    @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -1856,8 +1803,6 @@ AsciiStrCpyS (
> 
>    This function is similar as strncpy_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>    If an error is returned, then the Destination is unmodified.
> 
>    @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -1944,8 +1889,6 @@ AsciiStrnCpyS (
> 
>    This function is similar as strcat_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>    If an error is returned, then the Destination is unmodified.
> 
>    @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -2040,8 +1983,6 @@ AsciiStrCatS (
> 
>    This function is similar as strncat_s defined in C11.
> 
> -  If an error would be returned, then the function will also ASSERT().
> -
>    If an error is returned, then the Destination is unmodified.
> 
>    @param  Destination              A pointer to a Null-terminated Ascii string.
> @@ -2154,12 +2095,6 @@ AsciiStrnCatS (
>    be ignored. Then, the function stops at the first character that is a not a
>    valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If String has no valid decimal digits in the above format, then 0 is stored
>    at the location pointed to by Data.
>    If the number represented by String exceeds the range defined by UINTN, then
> @@ -2266,12 +2201,6 @@ AsciiStrDecimalToUintnS (
>    be ignored. Then, the function stops at the first character that is a not a
>    valid decimal character or a Null-terminator, whichever one comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If String has no valid decimal digits in the above format, then 0 is stored
>    at the location pointed to by Data.
>    If the number represented by String exceeds the range defined by UINT64, then
> @@ -2382,12 +2311,6 @@ AsciiStrDecimalToUint64S (
>    character that is a not a valid hexadecimal character or Null-terminator,
>    whichever on comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If String has no valid hexadecimal digits in the above format, then 0 is
>    stored at the location pointed to by Data.
>    If the number represented by String exceeds the range defined by UINTN, then
> @@ -2509,12 +2432,6 @@ AsciiStrHexToUintnS (
>    character that is a not a valid hexadecimal character or Null-terminator,
>    whichever on comes first.
> 
> -  If String is NULL, then ASSERT().
> -  If Data is NULL, then ASSERT().
> -  If PcdMaximumAsciiStringLength is not zero, and String contains more than
> -  PcdMaximumAsciiStringLength Ascii characters, not including the
> -  Null-terminator, then ASSERT().
> -
>    If String has no valid hexadecimal digits in the above format, then 0 is
>    stored at the location pointed to by Data.
>    If the number represented by String exceeds the range defined by UINT64, then
> @@ -2635,7 +2552,6 @@ AsciiStrHexToUint64S (
>    the upper 8 bits, then ASSERT().
> 
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -2735,7 +2651,6 @@ UnicodeStrToAsciiStrS (
>    If any Unicode characters in Source contain non-zero value in the upper 8
>    bits, then ASSERT().
>    If Source is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then Destination and DestinationLength are
>    unmodified.
> @@ -2855,7 +2770,6 @@ UnicodeStrnToAsciiStrS (
>    equal or greater than ((AsciiStrLen (Source) + 1) * sizeof (CHAR16)) in bytes.
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then the Destination is unmodified.
> 
> @@ -2948,7 +2862,6 @@ AsciiStrToUnicodeStrS (
>    ((MIN(AsciiStrLen(Source), Length) + 1) * sizeof (CHAR8)) in bytes.
> 
>    If Destination is not aligned on a 16-bit boundary, then ASSERT().
> -  If an error would be returned, then the function will also ASSERT().
> 
>    If an error is returned, then Destination and DestinationLength are
>    unmodified.
> @@ -3072,10 +2985,6 @@ AsciiStrnToUnicodeStrS (
>    "::" can be used to compress one or more groups of X when X contains only 0.
>    The "::" can only appear once in the String.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>    If EndPointer is not NULL and Address is translated from String, a pointer
>    to the character that stopped the scan is stored at the location pointed to
>    by EndPointer.
> @@ -3291,10 +3200,6 @@ AsciiStrToIpv6Address (
>    When /P is in the String, the function stops at the first character that is not
>    a valid decimal digit character after P is converted.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Address is NULL, then ASSERT().
> -
>    If EndPointer is not NULL and Address is translated from String, a pointer
>    to the character that stopped the scan is stored at the location pointed to
>    by EndPointer.
> @@ -3448,9 +3353,6 @@ AsciiStrToIpv4Address (
>                    oo          Data4[48:55]
>                    pp          Data4[56:63]
> 
> -  If String is NULL, then ASSERT().
> -  If Guid is NULL, then ASSERT().
> -
>    @param  String                   Pointer to a Null-terminated ASCII string.
>    @param  Guid                     Pointer to the converted GUID.
> 
> @@ -3550,17 +3452,6 @@ AsciiStrToGuid (
>    decoding stops after Length of characters and outputs Buffer containing
>    (Length / 2) bytes.
> 
> -  If String is NULL, then ASSERT().
> -
> -  If Buffer is NULL, then ASSERT().
> -
> -  If Length is not multiple of 2, then ASSERT().
> -
> -  If PcdMaximumAsciiStringLength is not zero and Length is greater than
> -  PcdMaximumAsciiStringLength, then ASSERT().
> -
> -  If MaxBufferSize is less than (Length / 2), then ASSERT().
> -
>    @param  String                   Pointer to a Null-terminated ASCII string.
>    @param  Length                   The number of ASCII characters to decode.
>    @param  Buffer                   Pointer to the converted bytes array.
> --
> 2.21.0.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#59971): https://edk2.groups.io/g/devel/message/59971
Mute This Topic: https://groups.io/mt/74341929/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.