EmbeddedPkg/Lan9118Dxe: Fix risk of buffer overflow.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Olivier Martin <olivier.martin@arm.com>
Reviewed-by: Ronald Cron <ronald.cron@arm.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17107 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.c b/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.c
index 3b7882d5d708d9bd11c78636f4c641d8a8a58530..5b7eda65c3b07a1fe518aeaa4bda9d415e1fa3f2 100644 (file)
--- a/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.c
+++ b/EmbeddedPkg/Drivers/Lan9118Dxe/Lan9118Dxe.c
@@ -1412,12 +1412,6 @@ SnpReceive (
   PLength = GET_RXSTATUS_PACKET_LENGTH(RxFifoStatus);\r
   LanDriver->Stats.RxTotalBytes += (PLength - 4);\r
 \r
-  // Check buffer size\r
-  if (*BuffSize < PLength) {\r
-    *BuffSize = PLength;\r
-    return EFI_BUFFER_TOO_SMALL;\r
-  }\r
-\r
   // If padding is applied, read more DWORDs\r
   if (PLength % 4) {\r
     Padding = 4 - (PLength % 4);\r
@@ -1427,6 +1421,12 @@ SnpReceive (
     Padding = 0;\r
   }\r
 \r
+  // Check buffer size\r
+  if (*BuffSize < (PLength + Padding)) {\r
+    *BuffSize = PLength + Padding;\r
+    return EFI_BUFFER_TOO_SMALL;\r
+  }\r
+\r
   // Set the amount of data to be transfered out of FIFO for THIS packet\r
   // This can be used to trigger an interrupt, and status can be checked\r
   RxCfgValue = MmioRead32 (LAN9118_RX_CFG);\r