diff options
author | Song, BinX <binx.song@intel.com> | 2017-04-07 14:52:15 +0800 |
---|---|---|
committer | Liming Gao <liming.gao@intel.com> | 2017-04-13 13:25:43 +0800 |
commit | 7dbcca88208e7463b95b6feb10df9a776fb42b46 (patch) | |
tree | 9b3b3c2803a011591d8d40775b6bc204a568cd71 | |
parent | 6aecbe2de8d7160875bda6321b23e8d8521d2af1 (diff) | |
download | edk2-platforms-7dbcca88208e7463b95b6feb10df9a776fb42b46.tar.xz |
MdeModulePkg: Fix BrotliCustomDecompressLib potential issue
- Fix BrotliCustomDecompressLib potential issue
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Bell Song <binx.song@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
(cherry picked from commit 36a0d5cab8c9a6ad628ca8e6ccb5d63ed87a53dd)
-rw-r--r-- | MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c | 1 | ||||
-rw-r--r-- | MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c | 12 |
2 files changed, 9 insertions, 4 deletions
diff --git a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c index 2c2648a83d..a30392148f 100644 --- a/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c +++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/BrotliDecompress.c @@ -126,6 +126,7 @@ BrotliDecompress ( BrotliState * BroState;
VOID * Temp;
+ TotalOut = 0;
AvailableOut = FILE_BUFFER_SIZE;
Result = BROTLI_RESULT_ERROR;
BroState = BrotliCreateState(BrAlloc, BrFree, BuffInfo);
diff --git a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c index 7ba1d0512e..67f0ff2cd9 100644 --- a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c +++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c @@ -802,6 +802,7 @@ static BROTLI_INLINE uint32_t ReadBlockLength(const HuffmanCode* table, uint32_t code;
uint32_t nbits;
code = ReadSymbol(table, br);
+ if (code >= BROTLI_NUM_BLOCK_LEN_SYMBOLS) code = BROTLI_NUM_BLOCK_LEN_SYMBOLS - 1;
nbits = kBlockLengthPrefixCode[code].nbits; /* nbits == 2..24 */
return kBlockLengthPrefixCode[code].offset + BrotliReadBits(br, nbits);
}
@@ -872,13 +873,13 @@ static BROTLI_NOINLINE void InverseMoveToFrontTransform( for (i = 0; i < v_len; ++i) {
int index = v[i];
uint8_t value = mtf[index];
- upper_bound |= v[i];
+ upper_bound |= (uint32_t)v[i];
v[i] = value;
mtf[-1] = value;
- do {
+ while (index > 0) {
index--;
mtf[index + 1] = mtf[index];
- } while (index >= 0);
+ }
}
/* Remember amount of elements to be reinitialized. */
state->mtf_upper_bound = upper_bound;
@@ -1498,6 +1499,7 @@ static BROTLI_INLINE BROTLI_BOOL ReadCommandInternal( return BROTLI_FALSE;
}
}
+ if (cmd_code >= BROTLI_NUM_COMMAND_SYMBOLS) cmd_code = BROTLI_NUM_COMMAND_SYMBOLS - 1;
v = kCmdLut[cmd_code];
s->distance_code = v.distance_code;
s->distance_context = v.context;
@@ -2209,7 +2211,9 @@ BrotliDecoderResult BrotliDecoderDecompressStream( }
s->max_distance = s->max_backward_distance;
if (s->state == BROTLI_STATE_COMMAND_POST_WRITE_1) {
- memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
+ if (s->ringbuffer != 0) {
+ memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
+ }
if (s->meta_block_remaining_len == 0) {
/* Next metablock, if any */
s->state = BROTLI_STATE_METABLOCK_DONE;
|