MdeModulePkg/HiiDB: Avoid incorrect results of multiplication

An example:
The codes in function Output8bitPixel in Image.c:
OffsetY = BITMAP_LEN_8_BIT ((UINT32) Image->Width, Ypos);

Both Image->Width and Ypos are of type UINT16. They will be promoted to
int (signed) first, and then perform the multiplication defined by macro
BITMAP_LEN_8_BIT. If the result of multiplication between Image->Width and
Ypos exceeds the range of type int, a potential incorrect results
will be assigned to OffsetY.

This commit adds explicit UINT32 type cast for 'Image->Width' to avoid
possible overflow in the int range. And also fix similar issues in
HiiDatabase.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Hao Wu <hao.a.wu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>

diff --git a/MdeModulePkg/Universal/HiiDatabaseDxe/Image.c b/MdeModulePkg/Universal/HiiDatabaseDxe/Image.c
index e2fa16e6e02bad5abee3cc8c79b68d2adee89930..431a5b84543b876522d0d9208ef568fed7642678 100644 (file)
--- a/MdeModulePkg/Universal/HiiDatabaseDxe/Image.c
+++ b/MdeModulePkg/Universal/HiiDatabaseDxe/Image.c
@@ -105,7 +105,7 @@ GetImageIdOrAddress (
     case EFI_HII_IIBT_IMAGE_8BIT_TRANS:\r
       Length = sizeof (EFI_HII_IIBT_IMAGE_8BIT_BLOCK) - sizeof (UINT8) +\r
                BITMAP_LEN_8_BIT (\r
-                 ReadUnaligned16 (&((EFI_HII_IIBT_IMAGE_8BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width),\r
+                 (UINT32) ReadUnaligned16 (&((EFI_HII_IIBT_IMAGE_8BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width),\r
                  ReadUnaligned16 (&((EFI_HII_IIBT_IMAGE_8BIT_BLOCK *) CurrentImageBlock)->Bitmap.Height)\r
                  );\r
       ImageIdCurrent++;\r
@@ -115,7 +115,7 @@ GetImageIdOrAddress (
     case EFI_HII_IIBT_IMAGE_24BIT_TRANS:\r
       Length = sizeof (EFI_HII_IIBT_IMAGE_24BIT_BLOCK) - sizeof (EFI_HII_RGB_PIXEL) +\r
                BITMAP_LEN_24_BIT (\r
-                 ReadUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width),\r
+                 (UINT32) ReadUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width),\r
                  ReadUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) CurrentImageBlock)->Bitmap.Height)\r
                  );\r
       ImageIdCurrent++;\r
@@ -453,7 +453,7 @@ Output8bitPixel (
   // Convert the pixel from 8 bits to corresponding color.\r
   //\r
   for (Ypos = 0; Ypos < Image->Height; Ypos++) {\r
-    OffsetY = BITMAP_LEN_8_BIT (Image->Width, Ypos);\r
+    OffsetY = BITMAP_LEN_8_BIT ((UINT32) Image->Width, Ypos);\r
     //\r
     // All bits are meaningful since the bitmap is 8 bits per pixel.\r
     //\r
@@ -493,7 +493,7 @@ Output24bitPixel (
   BitMapPtr = Image->Bitmap;\r
 \r
   for (Ypos = 0; Ypos < Image->Height; Ypos++) {\r
-    OffsetY = BITMAP_LEN_8_BIT (Image->Width, Ypos);\r
+    OffsetY = BITMAP_LEN_8_BIT ((UINT32) Image->Width, Ypos);\r
     CopyRgbToGopPixel (&BitMapPtr[OffsetY], &Data[OffsetY], Image->Width);\r
   }\r
 \r
@@ -650,7 +650,7 @@ HiiNewImage (
   }\r
 \r
   NewBlockSize = sizeof (EFI_HII_IIBT_IMAGE_24BIT_BLOCK) - sizeof (EFI_HII_RGB_PIXEL) +\r
-                 BITMAP_LEN_24_BIT (Image->Width, Image->Height);\r
+                 BITMAP_LEN_24_BIT ((UINT32) Image->Width, Image->Height);\r
 \r
   //\r
   // Get the image package in the package list,\r
@@ -753,7 +753,7 @@ HiiNewImage (
   }\r
   WriteUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) ImageBlocks)->Bitmap.Width, Image->Width);\r
   WriteUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) ImageBlocks)->Bitmap.Height, Image->Height);\r
-  CopyGopToRgbPixel (((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) ImageBlocks)->Bitmap.Bitmap, Image->Bitmap, Image->Width * Image->Height);\r
+  CopyGopToRgbPixel (((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) ImageBlocks)->Bitmap.Bitmap, Image->Bitmap, (UINT32) Image->Width * Image->Height);\r
 \r
   //\r
   // Append the block end\r
@@ -896,7 +896,7 @@ IGetImage (
     //\r
     CopyMem (&Iibt1bit, CurrentImageBlock, sizeof (EFI_HII_IIBT_IMAGE_1BIT_BLOCK));\r
     ImageLength = sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) *\r
-                  (Iibt1bit.Bitmap.Width * Iibt1bit.Bitmap.Height);\r
+                  ((UINT32) Iibt1bit.Bitmap.Width * Iibt1bit.Bitmap.Height);\r
     Image->Bitmap = AllocateZeroPool (ImageLength);\r
     if (Image->Bitmap == NULL) {\r
       return EFI_OUT_OF_RESOURCES;\r
@@ -947,7 +947,7 @@ IGetImage (
   case EFI_HII_IIBT_IMAGE_24BIT:\r
     Width = ReadUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width);\r
     Height = ReadUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) CurrentImageBlock)->Bitmap.Height);\r
-    ImageLength = sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) * (Width * Height);\r
+    ImageLength = sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) * ((UINT32) Width * Height);\r
     Image->Bitmap = AllocateZeroPool (ImageLength);\r
     if (Image->Bitmap == NULL) {\r
       return EFI_OUT_OF_RESOURCES;\r
@@ -1095,7 +1095,7 @@ HiiSetImage (
   case EFI_HII_IIBT_IMAGE_8BIT_TRANS:\r
     OldBlockSize = sizeof (EFI_HII_IIBT_IMAGE_8BIT_BLOCK) - sizeof (UINT8) +\r
                    BITMAP_LEN_8_BIT (\r
-                     ReadUnaligned16 (&((EFI_HII_IIBT_IMAGE_8BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width),\r
+                     (UINT32) ReadUnaligned16 (&((EFI_HII_IIBT_IMAGE_8BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width),\r
                      ReadUnaligned16 (&((EFI_HII_IIBT_IMAGE_8BIT_BLOCK *) CurrentImageBlock)->Bitmap.Height)\r
                      );\r
     break;\r
@@ -1103,7 +1103,7 @@ HiiSetImage (
   case EFI_HII_IIBT_IMAGE_24BIT_TRANS:\r
     OldBlockSize = sizeof (EFI_HII_IIBT_IMAGE_24BIT_BLOCK) - sizeof (EFI_HII_RGB_PIXEL) +\r
                    BITMAP_LEN_24_BIT (\r
-                     ReadUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width),\r
+                     (UINT32) ReadUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) CurrentImageBlock)->Bitmap.Width),\r
                      ReadUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) CurrentImageBlock)->Bitmap.Height)\r
                      );\r
     break;\r
@@ -1115,7 +1115,7 @@ HiiSetImage (
   // Create the new image block according to input image.\r
   //\r
   NewBlockSize = sizeof (EFI_HII_IIBT_IMAGE_24BIT_BLOCK) - sizeof (EFI_HII_RGB_PIXEL) +\r
-                 BITMAP_LEN_24_BIT (Image->Width, Image->Height);\r
+                 BITMAP_LEN_24_BIT ((UINT32) Image->Width, Image->Height);\r
   //\r
   // Adjust the image package to remove the original block firstly then add the new block.\r
   //\r
@@ -1140,7 +1140,7 @@ HiiSetImage (
   WriteUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) NewImageBlock)->Bitmap.Width, Image->Width);\r
   WriteUnaligned16 ((VOID *) &((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) NewImageBlock)->Bitmap.Height, Image->Height);\r
   CopyGopToRgbPixel (((EFI_HII_IIBT_IMAGE_24BIT_BLOCK *) NewImageBlock)->Bitmap.Bitmap,\r
-                       Image->Bitmap, Image->Width * Image->Height);\r
+                       Image->Bitmap, (UINT32) Image->Width * Image->Height);\r
 \r
   CopyMem ((UINT8 *) NewImageBlock + NewBlockSize, (UINT8 *) CurrentImageBlock + OldBlockSize, Part2Size);\r
 \r