diff options
5 files changed, 74 insertions, 35 deletions
diff --git a/IntelFrameworkModulePkg/Bus/Isa/IsaBusDxe/IsaIo.c b/IntelFrameworkModulePkg/Bus/Isa/IsaBusDxe/IsaIo.c index da1aa94094..3907e0a6c7 100644 --- a/IntelFrameworkModulePkg/Bus/Isa/IsaBusDxe/IsaIo.c +++ b/IntelFrameworkModulePkg/Bus/Isa/IsaBusDxe/IsaIo.c @@ -1065,6 +1065,11 @@ IsaIoMap_FullSupport ( if (Operation < 0 || Operation >= EfiIsaIoOperationMaximum) {
return EFI_INVALID_PARAMETER;
}
+
+ if (ChannelNumber >= 8) {
+ return EFI_INVALID_PARAMETER;
+ }
+
//
// See if this is a Slave DMA Operation
//
diff --git a/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/Ide.c b/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/Ide.c index 6ffc2fcf2b..ed02b38dcf 100644 --- a/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/Ide.c +++ b/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/Ide.c @@ -373,6 +373,10 @@ ReassignIdeResources ( UINT16 CommandBlockBaseAddr;
UINT16 ControlBlockBaseAddr;
+ if (IdeDev->Channel >= IdeMaxChannel) {
+ return EFI_INVALID_PARAMETER;
+ }
+
//
// Requery IDE IO port registers' base addresses in case of the switch of
// native and legacy modes
diff --git a/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/IdeBus.c b/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/IdeBus.c index fb86e55480..b09bb8a53f 100644 --- a/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/IdeBus.c +++ b/IntelFrameworkModulePkg/Bus/Pci/IdeBusDxe/IdeBus.c @@ -360,6 +360,14 @@ IDEBusDriverBindingStart ( EndIdeChannel = BeginningIdeChannel;
BeginningIdeDevice = Node->Atapi.SlaveMaster;
EndIdeDevice = BeginningIdeDevice;
+ if (BeginningIdeChannel >= IdeMaxChannel || EndIdeChannel >= IdeMaxChannel) {
+ Status = EFI_INVALID_PARAMETER;
+ goto ErrorExit;
+ }
+ if (BeginningIdeDevice >= IdeMaxDevice|| EndIdeDevice >= IdeMaxDevice) {
+ Status = EFI_INVALID_PARAMETER;
+ goto ErrorExit;
+ }
}
//
@@ -1030,8 +1038,9 @@ DeRegisterIdeDevice ( // Release allocated resources
//
Index = IdeBlkIoDevice->Channel * 2 + IdeBlkIoDevice->Device;
- IdeBlkIoDevice->IdeBusDriverPrivateData->HaveScannedDevice[Index] = FALSE;
-
+ if (Index < MAX_IDE_DEVICE) {
+ IdeBlkIoDevice->IdeBusDriverPrivateData->HaveScannedDevice[Index] = FALSE;
+ }
ReleaseIdeResources (IdeBlkIoDevice);
return EFI_SUCCESS;
diff --git a/IntelFrameworkModulePkg/Bus/Pci/PciBusDxe/PciDeviceSupport.c b/IntelFrameworkModulePkg/Bus/Pci/PciBusDxe/PciDeviceSupport.c index d461aef4d0..320eb4c62d 100644 --- a/IntelFrameworkModulePkg/Bus/Pci/PciBusDxe/PciDeviceSupport.c +++ b/IntelFrameworkModulePkg/Bus/Pci/PciBusDxe/PciDeviceSupport.c @@ -1202,7 +1202,11 @@ GetHpcPciAddressFromRootBridge ( return EFI_NOT_FOUND;
}
- *PciAddress = EFI_PCI_ADDRESS (Temp->BusNumber, Temp->DeviceNumber, Temp->FunctionNumber, 0);
+ if (Temp != NULL) {
+ *PciAddress = EFI_PCI_ADDRESS (Temp->BusNumber, Temp->DeviceNumber, Temp->FunctionNumber, 0);
+ } else {
+ return EFI_NOT_FOUND;
+ }
return EFI_SUCCESS;
diff --git a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c index 24755b002a..532f392ca5 100644 --- a/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c +++ b/IntelFrameworkModulePkg/Library/BaseUefiTianoCustomDecompressLib/BaseUefiTianoCustomDecompressLib.c @@ -127,14 +127,15 @@ MakeTable ( UINT16 WordOfStart;
UINT16 WordOfCount;
- for (Index = 1; Index <= 16; Index++) {
+ for (Index = 0; Index <= 16; Index++) {
Count[Index] = 0;
}
for (Index = 0; Index < NumOfChar; Index++) {
Count[BitLen[Index]]++;
}
-
+
+ Start[0] = 0;
Start[1] = 0;
for (Index = 1; Index <= 16; Index++) {
@@ -149,7 +150,8 @@ MakeTable ( }
JuBits = (UINT16) (16 - TableBits);
-
+
+ Weight[0] = 0;
for (Index = 1; Index <= TableBits; Index++) {
Start[Index] >>= JuBits;
Weight[Index] = (UINT16) (1U << (TableBits - Index));
@@ -157,15 +159,15 @@ MakeTable ( while (Index <= 16) {
Weight[Index] = (UINT16) (1U << (16 - Index));
- Index++;
+ Index++;
}
Index = (UINT16) (Start[TableBits + 1] >> JuBits);
if (Index != 0) {
Index3 = (UINT16) (1U << TableBits);
- while (Index != Index3) {
- Table[Index++] = 0;
+ if (Index < Index3) {
+ SetMem16 (Table + Index, (Index3 - Index) * sizeof (*Table), 0);
}
}
@@ -175,7 +177,7 @@ MakeTable ( for (Char = 0; Char < NumOfChar; Char++) {
Len = BitLen[Char];
- if (Len == 0) {
+ if (Len == 0 || Len >= 17) {
continue;
}
@@ -194,15 +196,17 @@ MakeTable ( Index = (UINT16) (Len - TableBits);
while (Index != 0) {
- if (*Pointer == 0) {
- Sd->mRight[Avail] = Sd->mLeft[Avail] = 0;
+ if (*Pointer == 0 && Avail < (2 * NC - 1)) {
+ Sd->mRight[Avail] = Sd->mLeft[Avail] = 0;
*Pointer = Avail++;
}
-
- if (Index3 & Mask) {
- Pointer = &Sd->mRight[*Pointer];
- } else {
- Pointer = &Sd->mLeft[*Pointer];
+
+ if (*Pointer < (2 * NC - 1)) {
+ if ((Index3 & Mask) != 0) {
+ Pointer = &Sd->mRight[*Pointer];
+ } else {
+ Pointer = &Sd->mLeft[*Pointer];
+ }
}
Index3 <<= 1;
@@ -294,28 +298,37 @@ ReadPTLen ( volatile UINT16 Index;
UINT32 Mask;
+ //
+ // Read Extra Set Code Length Array size
+ //
Number = (UINT16) GetBits (Sd, nbit);
if (Number == 0) {
+ //
+ // This represents only Huffman code used
+ //
CharC = (UINT16) GetBits (Sd, nbit);
for (Index = 0; Index < 256; Index++) {
Sd->mPTTable[Index] = CharC;
}
- for (Index = 0; Index < nn; Index++) {
- Sd->mPTLen[Index] = 0;
- }
+ SetMem (Sd->mPTLen, nn, 0);
return 0;
}
Index = 0;
- while (Index < Number) {
+ while (Index < Number && Index < NPT) {
CharC = (UINT16) (Sd->mBitBuf >> (BITBUFSIZ - 3));
+ //
+ // If a code length is less than 7, then it is encoded as a 3-bit
+ // value. Or it is encoded as a series of "1"s followed by a
+ // terminating "0". The number of "1"s = Code length - 4.
+ //
if (CharC == 7) {
Mask = 1U << (BITBUFSIZ - 1 - 3);
while (Mask & Sd->mBitBuf) {
@@ -323,23 +336,29 @@ ReadPTLen ( CharC += 1;
}
}
-
+
FillBuf (Sd, (UINT16) ((CharC < 7) ? 3 : CharC - 3));
Sd->mPTLen[Index++] = (UINT8) CharC;
-
+
+ //
+ // For Code&Len Set,
+ // After the third length of the code length concatenation,
+ // a 2-bit value is used to indicated the number of consecutive
+ // zero lengths after the third length.
+ //
if (Index == Special) {
CharC = (UINT16) GetBits (Sd, 2);
- while ((INT16) (--CharC) >= 0) {
+ while ((INT16) (--CharC) >= 0 && Index < NPT) {
Sd->mPTLen[Index++] = 0;
}
}
}
- while (Index < nn) {
+ while (Index < nn && Index < NPT) {
Sd->mPTLen[Index++] = 0;
}
-
+
return MakeTable (Sd, nn, Sd->mPTLen, 8, Sd->mPTTable);
}
@@ -365,11 +384,12 @@ ReadCLen ( Number = (UINT16) GetBits (Sd, CBIT);
if (Number == 0) {
+ //
+ // This represents only Huffman code used
+ //
CharC = (UINT16) GetBits (Sd, CBIT);
- for (Index = 0; Index < NC; Index++) {
- Sd->mCLen[Index] = 0;
- }
+ SetMem (Sd->mCLen, NC, 0);
for (Index = 0; Index < 4096; Index++) {
Sd->mCTable[Index] = CharC;
@@ -379,8 +399,7 @@ ReadCLen ( }
Index = 0;
- while (Index < Number) {
-
+ while (Index < Number && Index < NC) {
CharC = Sd->mPTTable[Sd->mBitBuf >> (BITBUFSIZ - 8)];
if (CharC >= NT) {
Mask = 1U << (BITBUFSIZ - 1 - 8);
@@ -412,7 +431,7 @@ ReadCLen ( CharC = (UINT16) (GetBits (Sd, CBIT) + 20);
}
- while ((INT16) (--CharC) >= 0) {
+ while ((INT16) (--CharC) >= 0 && Index < NC) {
Sd->mCLen[Index++] = 0;
}
@@ -423,9 +442,7 @@ ReadCLen ( }
}
- while (Index < NC) {
- Sd->mCLen[Index++] = 0;
- }
+ SetMem (Sd->mCLen + Index, NC - Index, 0);
MakeTable (Sd, NC, Sd->mCLen, 12, Sd->mCTable);
|