From 2054fd132a4ffd9cb2dcdcece691c5f5db9b9b4e Mon Sep 17 00:00:00 2001
From: lgao4 <lgao4@6f19259b-4bc3-4df7-8a09-765794883524>
Date: Tue, 30 Oct 2012 08:35:08 +0000
Subject: Fix memory out of band access in AsmFxSave() and AsmFxRestore().

Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>


git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13894 6f19259b-4bc3-4df7-8a09-765794883524
---
 MdePkg/Library/BaseLib/X86FxRestore.c | 4 ++--
 MdePkg/Library/BaseLib/X86FxSave.c    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'MdePkg/Library/BaseLib')

diff --git a/MdePkg/Library/BaseLib/X86FxRestore.c b/MdePkg/Library/BaseLib/X86FxRestore.c
index d93cc91df3..b2a02fe25f 100644
--- a/MdePkg/Library/BaseLib/X86FxRestore.c
+++ b/MdePkg/Library/BaseLib/X86FxRestore.c
@@ -1,7 +1,7 @@
 /** @file
   IA-32/x64 AsmFxRestore()
 
-  Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -43,7 +43,7 @@ AsmFxRestore (
   //
   // Check the flag recorded by AsmFxSave()
   //
-  ASSERT (0xAA5555AA == *(UINT32 *) (&Buffer[sizeof (IA32_FX_BUFFER) - 4]));
+  ASSERT (0xAA5555AA == *(UINT32 *) (&Buffer->Buffer[sizeof (Buffer->Buffer) - 4]));
 
   InternalX86FxRestore (Buffer);
 }
diff --git a/MdePkg/Library/BaseLib/X86FxSave.c b/MdePkg/Library/BaseLib/X86FxSave.c
index 2dc935079e..0a40bcc2c4 100644
--- a/MdePkg/Library/BaseLib/X86FxSave.c
+++ b/MdePkg/Library/BaseLib/X86FxSave.c
@@ -1,7 +1,7 @@
 /** @file
   IA-32/x64 AsmFxSave()
 
-  Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -44,5 +44,5 @@ AsmFxSave (
   //
   // Mark one flag at end of Buffer, it will be check by AsmFxRestor()
   //
-  *(UINT32 *) (&Buffer[sizeof (IA32_FX_BUFFER) - 4]) = 0xAA5555AA;
+  *(UINT32 *) (&Buffer->Buffer[sizeof (Buffer->Buffer) - 4]) = 0xAA5555AA;
 }
-- 
cgit v1.2.3