MdeModulePkg/BmpSupportLib: Check PixelHeight/PixelWidth against 0
[mirror_edk2.git] / MdeModulePkg / Library / BaseBmpSupportLib / BmpSupportLib.c
1 /** @file
2
3 Provides services to convert a BMP graphics image to a GOP BLT buffer and
4 from a GOP BLT buffer to a BMP graphics image.
5
6 Caution: This module requires additional review when modified.
7 This module processes external input - BMP image.
8 This external input must be validated carefully to avoid security issue such
9 as buffer overflow, integer overflow.
10
11 TranslateBmpToGopBlt() receives untrusted input and performs basic validation.
12
13 Copyright (c) 2016-2017, Microsoft Corporation
14 Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>
15
16 All rights reserved.
17 Redistribution and use in source and binary forms, with or without
18 modification, are permitted provided that the following conditions are met:
19 1. Redistributions of source code must retain the above copyright notice,
20 this list of conditions and the following disclaimer.
21 2. Redistributions in binary form must reproduce the above copyright notice,
22 this list of conditions and the following disclaimer in the documentation
23 and/or other materials provided with the distribution.
24
25 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
26 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
27 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28 IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
29 INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
30 BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
32 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
33 OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
34 ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35
36 **/
37
38 #include <PiDxe.h>
39 #include <Library/DebugLib.h>
40 #include <Library/BaseMemoryLib.h>
41 #include <Library/MemoryAllocationLib.h>
42 #include <Library/SafeIntLib.h>
43 #include <IndustryStandard/Bmp.h>
44
45 #include <Library/BmpSupportLib.h>
46
47 //
48 // BMP Image header for an uncompressed 24-bit per pixel BMP image.
49 //
50 const BMP_IMAGE_HEADER mBmpImageHeaderTemplate = {
51 'B', // CharB
52 'M', // CharM
53 0, // Size will be updated at runtime
54 {0, 0}, // Reserved
55 sizeof (BMP_IMAGE_HEADER), // ImageOffset
56 sizeof (BMP_IMAGE_HEADER) - OFFSET_OF (BMP_IMAGE_HEADER, HeaderSize), // HeaderSize
57 0, // PixelWidth will be updated at runtime
58 0, // PixelHeight will be updated at runtime
59 1, // Planes
60 24, // BitPerPixel
61 0, // CompressionType
62 0, // ImageSize will be updated at runtime
63 0, // XPixelsPerMeter
64 0, // YPixelsPerMeter
65 0, // NumberOfColors
66 0 // ImportantColors
67 };
68
69 /**
70 Translate a *.BMP graphics image to a GOP blt buffer. If a NULL Blt buffer
71 is passed in a GopBlt buffer will be allocated by this routine using
72 EFI_BOOT_SERVICES.AllocatePool(). If a GopBlt buffer is passed in it will be
73 used if it is big enough.
74
75 @param[in] BmpImage Pointer to BMP file.
76 @param[in] BmpImageSize Number of bytes in BmpImage.
77 @param[in, out] GopBlt Buffer containing GOP version of BmpImage.
78 @param[in, out] GopBltSize Size of GopBlt in bytes.
79 @param[out] PixelHeight Height of GopBlt/BmpImage in pixels.
80 @param[out] PixelWidth Width of GopBlt/BmpImage in pixels.
81
82 @retval RETURN_SUCCESS GopBlt and GopBltSize are returned.
83 @retval RETURN_INVALID_PARAMETER BmpImage is NULL.
84 @retval RETURN_INVALID_PARAMETER GopBlt is NULL.
85 @retval RETURN_INVALID_PARAMETER GopBltSize is NULL.
86 @retval RETURN_INVALID_PARAMETER PixelHeight is NULL.
87 @retval RETURN_INVALID_PARAMETER PixelWidth is NULL.
88 @retval RETURN_UNSUPPORTED BmpImage is not a valid *.BMP image.
89 @retval RETURN_BUFFER_TOO_SMALL The passed in GopBlt buffer is not big
90 enough. The required size is returned in
91 GopBltSize.
92 @retval RETURN_OUT_OF_RESOURCES The GopBlt buffer could not be allocated.
93
94 **/
95 RETURN_STATUS
96 EFIAPI
97 TranslateBmpToGopBlt (
98 IN VOID *BmpImage,
99 IN UINTN BmpImageSize,
100 IN OUT EFI_GRAPHICS_OUTPUT_BLT_PIXEL **GopBlt,
101 IN OUT UINTN *GopBltSize,
102 OUT UINTN *PixelHeight,
103 OUT UINTN *PixelWidth
104 )
105 {
106 UINT8 *Image;
107 UINT8 *ImageHeader;
108 BMP_IMAGE_HEADER *BmpHeader;
109 BMP_COLOR_MAP *BmpColorMap;
110 EFI_GRAPHICS_OUTPUT_BLT_PIXEL *BltBuffer;
111 EFI_GRAPHICS_OUTPUT_BLT_PIXEL *Blt;
112 UINT32 BltBufferSize;
113 UINTN Index;
114 UINTN Height;
115 UINTN Width;
116 UINTN ImageIndex;
117 UINT32 DataSizePerLine;
118 BOOLEAN IsAllocated;
119 UINT32 ColorMapNum;
120 RETURN_STATUS Status;
121 UINT32 DataSize;
122 UINT32 Temp;
123
124 if (BmpImage == NULL || GopBlt == NULL || GopBltSize == NULL) {
125 return RETURN_INVALID_PARAMETER;
126 }
127 if (PixelHeight == NULL || PixelWidth == NULL) {
128 return RETURN_INVALID_PARAMETER;
129 }
130
131 if (BmpImageSize < sizeof (BMP_IMAGE_HEADER)) {
132 DEBUG ((DEBUG_ERROR, "TranslateBmpToGopBlt: BmpImageSize too small\n"));
133 return RETURN_UNSUPPORTED;
134 }
135
136 BmpHeader = (BMP_IMAGE_HEADER *)BmpImage;
137
138 if (BmpHeader->CharB != 'B' || BmpHeader->CharM != 'M') {
139 DEBUG ((DEBUG_ERROR, "TranslateBmpToGopBlt: BmpHeader->Char fields incorrect\n"));
140 return RETURN_UNSUPPORTED;
141 }
142
143 //
144 // Doesn't support compress.
145 //
146 if (BmpHeader->CompressionType != 0) {
147 DEBUG ((DEBUG_ERROR, "TranslateBmpToGopBlt: Compression Type unsupported.\n"));
148 return RETURN_UNSUPPORTED;
149 }
150
151 if ((BmpHeader->PixelHeight == 0) || (BmpHeader->PixelWidth == 0)) {
152 DEBUG ((DEBUG_ERROR, "TranslateBmpToGopBlt: BmpHeader->PixelHeight or BmpHeader->PixelWidth is 0.\n"));
153 return RETURN_UNSUPPORTED;
154 }
155
156 //
157 // Only support BITMAPINFOHEADER format.
158 // BITMAPFILEHEADER + BITMAPINFOHEADER = BMP_IMAGE_HEADER
159 //
160 if (BmpHeader->HeaderSize != sizeof (BMP_IMAGE_HEADER) - OFFSET_OF (BMP_IMAGE_HEADER, HeaderSize)) {
161 DEBUG ((
162 DEBUG_ERROR,
163 "TranslateBmpToGopBlt: BmpHeader->Headership is not as expected. Headersize is 0x%x\n",
164 BmpHeader->HeaderSize
165 ));
166 return RETURN_UNSUPPORTED;
167 }
168
169 //
170 // The data size in each line must be 4 byte alignment.
171 //
172 Status = SafeUint32Mult (
173 BmpHeader->PixelWidth,
174 BmpHeader->BitPerPixel,
175 &DataSizePerLine
176 );
177 if (EFI_ERROR (Status)) {
178 DEBUG ((
179 DEBUG_ERROR,
180 "TranslateBmpToGopBlt: invalid BmpImage... PixelWidth:0x%x BitPerPixel:0x%x\n",
181 BmpHeader->PixelWidth,
182 BmpHeader->BitPerPixel
183 ));
184 return RETURN_UNSUPPORTED;
185 }
186
187 Status = SafeUint32Add (DataSizePerLine, 31, &DataSizePerLine);
188 if (EFI_ERROR (Status)) {
189 DEBUG ((
190 DEBUG_ERROR,
191 "TranslateBmpToGopBlt: invalid BmpImage... DataSizePerLine:0x%x\n",
192 DataSizePerLine
193 ));
194
195 return RETURN_UNSUPPORTED;
196 }
197
198 DataSizePerLine = (DataSizePerLine >> 3) &(~0x3);
199 Status = SafeUint32Mult (
200 DataSizePerLine,
201 BmpHeader->PixelHeight,
202 &BltBufferSize
203 );
204
205 if (EFI_ERROR (Status)) {
206 DEBUG ((
207 DEBUG_ERROR,
208 "TranslateBmpToGopBlt: invalid BmpImage... DataSizePerLine:0x%x PixelHeight:0x%x\n",
209 DataSizePerLine, BmpHeader->PixelHeight
210 ));
211
212 return RETURN_UNSUPPORTED;
213 }
214
215 Status = SafeUint32Mult (
216 BmpHeader->PixelHeight,
217 DataSizePerLine,
218 &DataSize
219 );
220
221 if (EFI_ERROR (Status)) {
222 DEBUG ((
223 DEBUG_ERROR,
224 "TranslateBmpToGopBlt: invalid BmpImage... PixelHeight:0x%x DataSizePerLine:0x%x\n",
225 BmpHeader->PixelHeight, DataSizePerLine
226 ));
227
228 return RETURN_UNSUPPORTED;
229 }
230
231 if ((BmpHeader->Size != BmpImageSize) ||
232 (BmpHeader->Size < BmpHeader->ImageOffset) ||
233 (BmpHeader->Size - BmpHeader->ImageOffset != DataSize)) {
234
235 DEBUG ((DEBUG_ERROR, "TranslateBmpToGopBlt: invalid BmpImage... \n"));
236 DEBUG ((DEBUG_ERROR, " BmpHeader->Size: 0x%x\n", BmpHeader->Size));
237 DEBUG ((DEBUG_ERROR, " BmpHeader->ImageOffset: 0x%x\n", BmpHeader->ImageOffset));
238 DEBUG ((DEBUG_ERROR, " BmpImageSize: 0x%lx\n", (UINTN)BmpImageSize));
239 DEBUG ((DEBUG_ERROR, " DataSize: 0x%lx\n", (UINTN)DataSize));
240
241 return RETURN_UNSUPPORTED;
242 }
243
244 //
245 // Calculate Color Map offset in the image.
246 //
247 Image = BmpImage;
248 BmpColorMap = (BMP_COLOR_MAP *)(Image + sizeof (BMP_IMAGE_HEADER));
249 if (BmpHeader->ImageOffset < sizeof (BMP_IMAGE_HEADER)) {
250 return RETURN_UNSUPPORTED;
251 }
252
253 if (BmpHeader->ImageOffset > sizeof (BMP_IMAGE_HEADER)) {
254 switch (BmpHeader->BitPerPixel) {
255 case 1:
256 ColorMapNum = 2;
257 break;
258 case 4:
259 ColorMapNum = 16;
260 break;
261 case 8:
262 ColorMapNum = 256;
263 break;
264 default:
265 ColorMapNum = 0;
266 break;
267 }
268 //
269 // BMP file may has padding data between the bmp header section and the
270 // bmp data section.
271 //
272 if (BmpHeader->ImageOffset - sizeof (BMP_IMAGE_HEADER) < sizeof (BMP_COLOR_MAP) * ColorMapNum) {
273 return RETURN_UNSUPPORTED;
274 }
275 }
276
277 //
278 // Calculate graphics image data address in the image
279 //
280 Image = ((UINT8 *)BmpImage) + BmpHeader->ImageOffset;
281 ImageHeader = Image;
282
283 //
284 // Calculate the BltBuffer needed size.
285 //
286 Status = SafeUint32Mult (
287 BmpHeader->PixelWidth,
288 BmpHeader->PixelHeight,
289 &BltBufferSize
290 );
291
292 if (EFI_ERROR (Status)) {
293 DEBUG ((
294 DEBUG_ERROR,
295 "TranslateBmpToGopBlt: invalid BltBuffer needed size... PixelWidth:0x%x PixelHeight:0x%x\n",
296 BmpHeader->PixelWidth, BmpHeader->PixelHeight
297 ));
298
299 return RETURN_UNSUPPORTED;
300 }
301
302 Temp = BltBufferSize;
303 Status = SafeUint32Mult (
304 BltBufferSize,
305 sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL),
306 &BltBufferSize
307 );
308
309 if (EFI_ERROR (Status)) {
310 DEBUG ((
311 DEBUG_ERROR,
312 "TranslateBmpToGopBlt: invalid BltBuffer needed size... PixelWidth x PixelHeight:0x%x struct size:0x%x\n",
313 Temp, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL)
314 ));
315
316 return RETURN_UNSUPPORTED;
317 }
318
319 IsAllocated = FALSE;
320 if (*GopBlt == NULL) {
321 //
322 // GopBlt is not allocated by caller.
323 //
324 DEBUG ((DEBUG_INFO, "Bmp Support: Allocating 0x%X bytes of memory\n", BltBufferSize));
325 *GopBltSize = (UINTN)BltBufferSize;
326 *GopBlt = AllocatePool (*GopBltSize);
327 IsAllocated = TRUE;
328 if (*GopBlt == NULL) {
329 return RETURN_OUT_OF_RESOURCES;
330 }
331 } else {
332 //
333 // GopBlt has been allocated by caller.
334 //
335 if (*GopBltSize < (UINTN)BltBufferSize) {
336 *GopBltSize = (UINTN)BltBufferSize;
337 return RETURN_BUFFER_TOO_SMALL;
338 }
339 }
340
341 *PixelWidth = BmpHeader->PixelWidth;
342 *PixelHeight = BmpHeader->PixelHeight;
343 DEBUG ((DEBUG_INFO, "BmpHeader->ImageOffset 0x%X\n", BmpHeader->ImageOffset));
344 DEBUG ((DEBUG_INFO, "BmpHeader->PixelWidth 0x%X\n", BmpHeader->PixelWidth));
345 DEBUG ((DEBUG_INFO, "BmpHeader->PixelHeight 0x%X\n", BmpHeader->PixelHeight));
346 DEBUG ((DEBUG_INFO, "BmpHeader->BitPerPixel 0x%X\n", BmpHeader->BitPerPixel));
347 DEBUG ((DEBUG_INFO, "BmpHeader->ImageSize 0x%X\n", BmpHeader->ImageSize));
348 DEBUG ((DEBUG_INFO, "BmpHeader->HeaderSize 0x%X\n", BmpHeader->HeaderSize));
349 DEBUG ((DEBUG_INFO, "BmpHeader->Size 0x%X\n", BmpHeader->Size));
350
351 //
352 // Translate image from BMP to Blt buffer format
353 //
354 BltBuffer = *GopBlt;
355 for (Height = 0; Height < BmpHeader->PixelHeight; Height++) {
356 Blt = &BltBuffer[ (BmpHeader->PixelHeight - Height - 1) * BmpHeader->PixelWidth];
357 for (Width = 0; Width < BmpHeader->PixelWidth; Width++, Image++, Blt++) {
358 switch (BmpHeader->BitPerPixel) {
359 case 1:
360 //
361 // Translate 1-bit (2 colors) BMP to 24-bit color
362 //
363 for (Index = 0; Index < 8 && Width < BmpHeader->PixelWidth; Index++) {
364 Blt->Red = BmpColorMap[ ((*Image) >> (7 - Index)) & 0x1].Red;
365 Blt->Green = BmpColorMap[ ((*Image) >> (7 - Index)) & 0x1].Green;
366 Blt->Blue = BmpColorMap[ ((*Image) >> (7 - Index)) & 0x1].Blue;
367 Blt++;
368 Width++;
369 }
370
371 Blt--;
372 Width--;
373 break;
374
375 case 4:
376 //
377 // Translate 4-bit (16 colors) BMP Palette to 24-bit color
378 //
379 Index = (*Image) >> 4;
380 Blt->Red = BmpColorMap[Index].Red;
381 Blt->Green = BmpColorMap[Index].Green;
382 Blt->Blue = BmpColorMap[Index].Blue;
383 if (Width < (BmpHeader->PixelWidth - 1)) {
384 Blt++;
385 Width++;
386 Index = (*Image) & 0x0f;
387 Blt->Red = BmpColorMap[Index].Red;
388 Blt->Green = BmpColorMap[Index].Green;
389 Blt->Blue = BmpColorMap[Index].Blue;
390 }
391 break;
392
393 case 8:
394 //
395 // Translate 8-bit (256 colors) BMP Palette to 24-bit color
396 //
397 Blt->Red = BmpColorMap[*Image].Red;
398 Blt->Green = BmpColorMap[*Image].Green;
399 Blt->Blue = BmpColorMap[*Image].Blue;
400 break;
401
402 case 24:
403 //
404 // It is 24-bit BMP.
405 //
406 Blt->Blue = *Image++;
407 Blt->Green = *Image++;
408 Blt->Red = *Image;
409 break;
410
411 case 32:
412 //
413 //Conver 32 bit to 24bit bmp - just ignore the final byte of each pixel
414 Blt->Blue = *Image++;
415 Blt->Green = *Image++;
416 Blt->Red = *Image++;
417 break;
418
419 default:
420 //
421 // Other bit format BMP is not supported.
422 //
423 if (IsAllocated) {
424 FreePool (*GopBlt);
425 *GopBlt = NULL;
426 }
427 DEBUG ((DEBUG_ERROR, "Bmp Bit format not supported. 0x%X\n", BmpHeader->BitPerPixel));
428 return RETURN_UNSUPPORTED;
429 break;
430 };
431
432 }
433
434 ImageIndex = (UINTN)Image - (UINTN)ImageHeader;
435 if ((ImageIndex % 4) != 0) {
436 //
437 // Bmp Image starts each row on a 32-bit boundary!
438 //
439 Image = Image + (4 - (ImageIndex % 4));
440 }
441 }
442
443 return RETURN_SUCCESS;
444 }
445
446 /**
447 Translate a GOP blt buffer to an uncompressed 24-bit per pixel BMP graphics
448 image. If a NULL BmpImage is passed in a BmpImage buffer will be allocated by
449 this routine using EFI_BOOT_SERVICES.AllocatePool(). If a BmpImage buffer is
450 passed in it will be used if it is big enough.
451
452 @param [in] GopBlt Pointer to GOP blt buffer.
453 @param [in] PixelHeight Height of GopBlt/BmpImage in pixels.
454 @param [in] PixelWidth Width of GopBlt/BmpImage in pixels.
455 @param [in, out] BmpImage Buffer containing BMP version of GopBlt.
456 @param [in, out] BmpImageSize Size of BmpImage in bytes.
457
458 @retval RETURN_SUCCESS BmpImage and BmpImageSize are returned.
459 @retval RETURN_INVALID_PARAMETER GopBlt is NULL.
460 @retval RETURN_INVALID_PARAMETER BmpImage is NULL.
461 @retval RETURN_INVALID_PARAMETER BmpImageSize is NULL.
462 @retval RETURN_UNSUPPORTED GopBlt cannot be converted to a *.BMP image.
463 @retval RETURN_BUFFER_TOO_SMALL The passed in BmpImage buffer is not big
464 enough. The required size is returned in
465 BmpImageSize.
466 @retval RETURN_OUT_OF_RESOURCES The BmpImage buffer could not be allocated.
467
468 **/
469 RETURN_STATUS
470 EFIAPI
471 TranslateGopBltToBmp (
472 IN EFI_GRAPHICS_OUTPUT_BLT_PIXEL *GopBlt,
473 IN UINT32 PixelHeight,
474 IN UINT32 PixelWidth,
475 IN OUT VOID **BmpImage,
476 IN OUT UINT32 *BmpImageSize
477 )
478 {
479 RETURN_STATUS Status;
480 UINT32 PaddingSize;
481 UINT32 BmpSize;
482 BMP_IMAGE_HEADER *BmpImageHeader;
483 UINT8 *Image;
484 UINTN Col;
485 UINTN Row;
486 EFI_GRAPHICS_OUTPUT_BLT_PIXEL *BltPixel;
487
488 if (GopBlt == NULL || BmpImage == NULL || BmpImageSize == NULL) {
489 return RETURN_INVALID_PARAMETER;
490 }
491
492 if ((PixelHeight == 0) || (PixelWidth == 0)) {
493 return RETURN_UNSUPPORTED;
494 }
495
496 //
497 // Allocate memory for BMP file.
498 //
499 PaddingSize = PixelWidth & 0x3;
500
501 //
502 // First check PixelWidth * 3 + PaddingSize doesn't overflow
503 //
504 Status = SafeUint32Mult (PixelWidth, 3, &BmpSize);
505 if (EFI_ERROR (Status)) {
506 DEBUG ((
507 DEBUG_ERROR,
508 "TranslateGopBltToBmp: GopBlt is too large. PixelHeight:0x%x PixelWidth:0x%x\n",
509 PixelHeight,
510 PixelWidth
511 ));
512 return RETURN_UNSUPPORTED;
513 }
514 Status = SafeUint32Add (BmpSize, PaddingSize, &BmpSize);
515 if (EFI_ERROR (Status)) {
516 DEBUG ((
517 DEBUG_ERROR,
518 "TranslateGopBltToBmp: GopBlt is too large. PixelHeight:0x%x PixelWidth:0x%x\n",
519 PixelHeight,
520 PixelWidth
521 ));
522 return RETURN_UNSUPPORTED;
523 }
524
525 //
526 // Second check (mLogoWidth * 3 + PaddingSize) * mLogoHeight + sizeof (BMP_IMAGE_HEADER) doesn't overflow
527 //
528 Status = SafeUint32Mult (BmpSize, PixelHeight, &BmpSize);
529 if (EFI_ERROR (Status)) {
530 DEBUG ((
531 DEBUG_ERROR,
532 "TranslateGopBltToBmp: GopBlt is too large. PixelHeight:0x%x PixelWidth:0x%x\n",
533 PixelHeight,
534 PixelWidth
535 ));
536 return RETURN_UNSUPPORTED;
537 }
538 Status = SafeUint32Add (BmpSize, sizeof (BMP_IMAGE_HEADER), &BmpSize);
539 if (EFI_ERROR (Status)) {
540 DEBUG ((
541 DEBUG_ERROR,
542 "TranslateGopBltToBmp: GopBlt is too large. PixelHeight:0x%x PixelWidth:0x%x\n",
543 PixelHeight,
544 PixelWidth
545 ));
546 return RETURN_UNSUPPORTED;
547 }
548
549 //
550 // The image should be stored in EfiBootServicesData, allowing the system to
551 // reclaim the memory
552 //
553 if (*BmpImage == NULL) {
554 *BmpImage = AllocateZeroPool (BmpSize);
555 if (*BmpImage == NULL) {
556 return EFI_OUT_OF_RESOURCES;
557 }
558 *BmpImageSize = BmpSize;
559 } else if (*BmpImageSize < BmpSize) {
560 *BmpImageSize = BmpSize;
561 return RETURN_BUFFER_TOO_SMALL;
562 }
563
564 BmpImageHeader = (BMP_IMAGE_HEADER *)*BmpImage;
565 CopyMem (BmpImageHeader, &mBmpImageHeaderTemplate, sizeof (BMP_IMAGE_HEADER));
566 BmpImageHeader->Size = *BmpImageSize;
567 BmpImageHeader->ImageSize = *BmpImageSize - sizeof (BMP_IMAGE_HEADER);
568 BmpImageHeader->PixelWidth = PixelWidth;
569 BmpImageHeader->PixelHeight = PixelHeight;
570
571 //
572 // Convert BLT buffer to BMP file.
573 //
574 Image = (UINT8 *)BmpImageHeader + sizeof (BMP_IMAGE_HEADER);
575 for (Row = 0; Row < PixelHeight; Row++) {
576 BltPixel = &GopBlt[(PixelHeight - Row - 1) * PixelWidth];
577
578 for (Col = 0; Col < PixelWidth; Col++) {
579 *Image++ = BltPixel->Blue;
580 *Image++ = BltPixel->Green;
581 *Image++ = BltPixel->Red;
582 BltPixel++;
583 }
584
585 //
586 // Padding for 4 byte alignment.
587 //
588 Image += PaddingSize;
589 }
590
591 return RETURN_SUCCESS;
592 }