add security check.

update functions comments.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@8832 6f19259b-4bc3-4df7-8a09-765794883524

4 files changed, 9 insertions, 6 deletions

diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.c b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.c
index aa5009abf3..559fd9ad0e 100644
--- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.c
+++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.c
@@ -542,6 +542,7 @@ DhcpFillOption (
   @param[out] OptionPoint            The array that contains the DHCP options. Caller

                                      should free it.

 

+  @retval EFI_NOT_FOUND          Cannot find any option.

   @retval EFI_OUT_OF_RESOURCES   Failed to allocate memory to parse the packet.

   @retval EFI_INVALID_PARAMETER  The options are mal-formated

   @retval EFI_SUCCESS            The options are parsed into OptionPoint

@@ -603,6 +604,7 @@ DhcpParseOption (
   *OptionPoint  = NULL;

 

   if (OptNum == 0) {

+    Status = EFI_NOT_FOUND;

     goto ON_EXIT;

   }

 

@@ -673,13 +675,12 @@ DhcpValidateOptions (
   if (EFI_ERROR (Status) || (Count == 0)) {

     return Status;

   }

-

+  

   Updated = FALSE;

   ZeroMem (&Parameter, sizeof (Parameter));

 

   for (Index = 0; Index < Count; Index++) {

     Option = &AllOption[Index];

-    ASSERT (Option != NULL);

 

     //

     // Find the format of the option then validate it.

diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.h b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.h
index 3574292ff4..3685b379ef 100644
--- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.h
+++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.h
@@ -280,6 +280,7 @@ DhcpValidateOptions (
   @param[out] OptionPoint            The array that contains the DHCP options. Caller

                                      should free it.

 

+  @retval EFI_NOT_FOUND          Cannot find any option.

   @retval EFI_OUT_OF_RESOURCES   Failed to allocate memory to parse the packet.

   @retval EFI_INVALID_PARAMETER  The options are mal-formated

   @retval EFI_SUCCESS            The options are parsed into OptionPoint

diff --git a/MdeModulePkg/Universal/Network/SnpDxe/Nvdata.c b/MdeModulePkg/Universal/Network/SnpDxe/Nvdata.c
index 20d5daa25c..8cd69bc37c 100644
--- a/MdeModulePkg/Universal/Network/SnpDxe/Nvdata.c
+++ b/MdeModulePkg/Universal/Network/SnpDxe/Nvdata.c
@@ -88,9 +88,9 @@ PxeNvDataRead (
     return EFI_DEVICE_ERROR;

   }

 

-  ASSERT ((Offset + BufferSize) <= sizeof (Db->Data));

+  ASSERT (Offset < sizeof (Db->Data));

 

-  CopyMem (Buffer, Db->Data.Byte + Offset, BufferSize);

+  CopyMem (Buffer, &Db->Data.Byte[Offset], BufferSize);

 

   return EFI_SUCCESS;

 }

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
index c04b2032c7..15a5b26d68 100644
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
@@ -1715,10 +1715,10 @@ PxeBcSelectBootMenu (
   }

 

   while (MenuSize > 0) {

-    MenuArray[Index]  = MenuItem;

+    MenuArray[Index++]  = MenuItem;

     MenuSize          = (UINT8) (MenuSize - (MenuItem->DescLen + 3));

     MenuItem          = (PXEBC_BOOT_MENU_ENTRY *) ((UINT8 *) MenuItem + MenuItem->DescLen + 3);

-    if (Index++ > (PXEBC_MAX_MENU_NUM - 1)) {

+    if (Index >= PXEBC_MAX_MENU_NUM) {

       break;

     }

   }

@@ -1738,6 +1738,7 @@ PxeBcSelectBootMenu (
   TopRow  = gST->ConOut->Mode->CursorRow - MenuNum;

 

   do {

+    ASSERT (Select < PXEBC_MAX_MENU_NUM);

     //

     // highlight selected row

     //