git: 42ed407622aa - stable/13 - libefivar: Fix a buffer overread.

The branch stable/13 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=42ed407622aa53f9794b9d3d378c725945d27623

commit 42ed407622aa53f9794b9d3d378c725945d27623
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2022-10-03 23:10:44 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2023-05-02 23:46:37 +0000

    libefivar: Fix a buffer overread.
    
    DevPathToTextUsbWWID allocates a separate copy of the SerialNumber
    string to append a null terminator if the original string is not
    null terminated.  However, by using AllocateCopyPool, it tries to
    copy 'Length + 1' words from the existing string containing 'Length'
    characters into the target string.  Split the copy out to only
    copy 'Length' characters instead.
    
    Reviewed by:    imp, emaste
    Reported by:    GCC 12 -Wstringop-overread
    Differential Revision:  https://reviews.freebsd.org/D36826
    
    (cherry picked from commit d30a1689f5b37e78ea189232a8b94a7011dc0dc8)
---
 lib/libefivar/efivar-dp-format.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/libefivar/efivar-dp-format.c b/lib/libefivar/efivar-dp-format.c
index 14f6adc2fd98..c6bb0f9dba7d 100644
--- a/lib/libefivar/efivar-dp-format.c
+++ b/lib/libefivar/efivar-dp-format.c
@@ -1008,9 +1008,10 @@ DevPathToTextUsbWWID (
     //
     // In case no NULL terminator in SerialNumber, create a new one with NULL terminator
     //
-    NewStr = AllocateCopyPool ((Length + 1) * sizeof (CHAR16), SerialNumberStr);
+    NewStr = AllocatePool ((Length + 1) * sizeof (CHAR16));
     ASSERT (NewStr != NULL);
-    NewStr [Length] = 0;
+    CopyMem (NewStr, SerialNumberStr, Length * sizeof (CHAR16));
+    NewStr[Length]  = 0;
     SerialNumberStr = NewStr;
   }