summaryrefslogtreecommitdiff
path: root/MdeModulePkg/Universal/Console
diff options
context:
space:
mode:
authorli-elvin <li-elvin@6f19259b-4bc3-4df7-8a09-765794883524>2012-10-17 06:07:27 +0000
committerli-elvin <li-elvin@6f19259b-4bc3-4df7-8a09-765794883524>2012-10-17 06:07:27 +0000
commit24ee1ccaf8310dd4f0bf591de7b71175cad5c865 (patch)
tree76b6b8ab88a7135691b47f0497b7521c42bd4946 /MdeModulePkg/Universal/Console
parent1a6fdcb009f9c4afad6dd6706264f970e69ed603 (diff)
downloadedk2-platforms-24ee1ccaf8310dd4f0bf591de7b71175cad5c865.tar.xz
Fix buffer overflow issue in Consplitter.
Signed-off-by: Li Elvin <elvin.li@intel.com> Reviewed-by: Ni Ruiyu <ruiyu.ni@intel.com> git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13857 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'MdeModulePkg/Universal/Console')
-rw-r--r--MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitter.c18
1 files changed, 16 insertions, 2 deletions
diff --git a/MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitter.c b/MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitter.c
index 2508273398..bcb9fd6f73 100644
--- a/MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitter.c
+++ b/MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitter.c
@@ -2109,6 +2109,8 @@ ConSplitterGrowMapTable (
INT32 *OldTextOutModeMap;
INT32 *SrcAddress;
INT32 Index;
+ UINTN OldStepSize;
+ UINTN NewStepSize;
NewSize = Private->TextOutListCount * sizeof (INT32);
OldTextOutModeMap = Private->TextOutModeMap;
@@ -2146,14 +2148,26 @@ ConSplitterGrowMapTable (
Size = Private->CurrentNumberOfConsoles * sizeof (INT32);
Index = 0;
SrcAddress = OldTextOutModeMap;
+ NewStepSize = NewSize / sizeof(INT32);
+ // If Private->CurrentNumberOfConsoles is not zero and OldTextOutModeMap
+ // is not NULL, it indicates that the original TextOutModeMap is not enough
+ // for the new console devices and has been enlarged by CONSOLE_SPLITTER_ALLOC_UNIT columns.
+ //
+ OldStepSize = NewStepSize - CONSOLE_SPLITTER_ALLOC_UNIT;
//
// Copy the old data to the new one
//
while (Index < Private->TextOutMode.MaxMode) {
CopyMem (TextOutModeMap, SrcAddress, Size);
- TextOutModeMap += NewSize;
- SrcAddress += Size;
+ //
+ // Go to next row of new TextOutModeMap.
+ //
+ TextOutModeMap += NewStepSize;
+ //
+ // Go to next row of old TextOutModeMap.
+ //
+ SrcAddress += OldStepSize;
Index++;
}
//