From 582c23689f1d8494d42d791c858cbe559d243b04 Mon Sep 17 00:00:00 2001 From: klu2 Date: Tue, 23 Jun 2009 09:36:17 +0000 Subject: Fix some potential buffer overflow issue. git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@8629 6f19259b-4bc3-4df7-8a09-765794883524 --- .../Universal/BdsDxe/BootMaint/UpdatePage.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c index dcc1fe2a13..6e5d61c4c4 100644 --- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c +++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c @@ -459,8 +459,8 @@ UpdateConsolePage ( UpdatePageStart (CallbackData); - ASSERT (ConsoleMenu->MenuNumber <= (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (CallbackData->BmmFakeNvData.ConsoleCheck[0]))); - for (Index = 0; Index < ConsoleMenu->MenuNumber; Index++) { + for (Index = 0; ((Index < ConsoleMenu->MenuNumber) && \ + (Index < (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (UINT8)))) ; Index++) { NewMenuEntry = BOpt_GetMenuEntry (ConsoleMenu, Index); NewConsoleContext = (BM_CONSOLE_CONTEXT *) NewMenuEntry->VariableContext; CheckFlags = 0; @@ -484,7 +484,8 @@ UpdateConsolePage ( ); } - for (Index2 = 0; Index2 < TerminalMenu.MenuNumber; Index2++) { + for (Index2 = 0; ((Index2 < TerminalMenu.MenuNumber) && \ + (Index2 < (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (UINT8)))); Index2++) { CheckFlags = 0; NewMenuEntry = BOpt_GetMenuEntry (&TerminalMenu, Index2); NewTerminalContext = (BM_TERMINAL_CONTEXT *) NewMenuEntry->VariableContext; @@ -548,7 +549,8 @@ UpdateOrderPage ( OptionsOpCodeHandle = HiiAllocateOpCodeHandle (); ASSERT (OptionsOpCodeHandle != NULL); - for (Index = 0; Index < OptionMenu->MenuNumber; Index++) { + for (Index = 0; ((Index < OptionMenu->MenuNumber) && \ + (Index < (sizeof (CallbackData->BmmFakeNvData.OptionOrder) / sizeof (UINT8))))); Index++) { NewMenuEntry = BOpt_GetMenuEntry (OptionMenu, Index); HiiCreateOneOfOptionOpCode ( OptionsOpCodeHandle, -- cgit v1.2.3