EdkCompatibilityPkg: Fix typos in comments

[mirror_edk2.git] / EdkCompatibilityPkg / Foundation / Library / Pei / PeiLib / Decompress.c

diff --git a/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c b/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c
index efcda80334271a24d3eb02f2e8cf9f3c6635f60f..595691932e0676c737db2f0fa69e384e6d0f5261 100644 (file)
--- a/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c
+++ b/EdkCompatibilityPkg/Foundation/Library/Pei/PeiLib/Decompress.c
@@ -1,7 +1,7 @@
 /*++\r
 \r
-Copyright (c) 2004, Intel Corporation                                                         \r
-All rights reserved. This program and the accompanying materials                          \r
+Copyright (c) 2004 - 2010, Intel Corporation. All rights reserved.<BR>\r
+This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
 http://opensource.org/licenses/bsd-license.php                                            \r
@@ -135,7 +135,9 @@ Returns:
 #define MAXMATCH  256\r
 #define THRESHOLD 3\r
 #define CODE_BIT  16\r
+#ifndef UINT8_MAX\r
 #define UINT8_MAX 0xff\r
+#endif\r
 #define BAD_TABLE - 1\r
 \r
 //\r
@@ -310,14 +312,32 @@ Returns:
   UINT16  NextCode;\r
   UINT16  Mask;\r
 \r
-  for (Index = 1; Index <= 16; Index++) {\r
+  //\r
+  // TableBits should not be greater than 16.\r
+  //\r
+  if (TableBits >= (sizeof (Count)/sizeof (UINT16))) {\r
+    return (UINT16) BAD_TABLE;\r
+  }\r
+ \r
+  //\r
+  // Initialize Count array starting from Index 0, as there is a possibility of Count array being uninitialized.\r
+  //\r
+  for (Index = 0; Index <= 16; Index++) {\r
     Count[Index] = 0;\r
   }\r
 \r
   for (Index = 0; Index < NumOfChar; Index++) {\r
-    Count[BitLen[Index]]++;\r
+    //\r
+    // Count array index should not be greater than or equal to its size.\r
+    //\r
+    if (BitLen[Index] < (sizeof (Count)/sizeof (UINT16))) {\r
+      Count[BitLen[Index]]++;\r
+    } else {\r
+      return (UINT16) BAD_TABLE;\r
+    }\r
   }\r
 \r
+  Start[0] = 0;\r
   Start[1] = 0;\r
 \r
   for (Index = 1; Index <= 16; Index++) {\r
@@ -356,7 +376,7 @@ Returns:
   for (Char = 0; Char < NumOfChar; Char++) {\r
 \r
     Len = BitLen[Char];\r
-    if (Len == 0) {\r
+    if (Len == 0 || Len >= 17) {\r
       continue;\r
     }\r
 \r
@@ -375,14 +395,20 @@ Returns:
       Index   = (UINT16) (Len - TableBits);\r
 \r
       while (Index != 0) {\r
-        if (*Pointer == 0) {\r
+        //\r
+        // Avail should be lesser than size of mRight and mLeft to prevent buffer overflow.\r
+        //\r
+        if ((*Pointer == 0) && (Avail < sizeof (Sd->mRight)/sizeof (UINT16)) && (Avail < sizeof (Sd->mLeft)/sizeof (UINT16))) {\r
           Sd->mRight[Avail]                     = Sd->mLeft[Avail] = 0;\r
           *Pointer = Avail++;\r
         }\r
 \r
-        if (Index3 & Mask) {\r
+        //\r
+        // *Pointer should be lesser than size of mRight and mLeft to prevent buffer overflow.\r
+        //\r
+        if ((Index3 & Mask) && (*Pointer < (sizeof (Sd->mRight)/sizeof (UINT16)))) {\r
           Pointer = &Sd->mRight[*Pointer];\r
-        } else {\r
+        } else if (*Pointer < (sizeof (Sd->mLeft)/sizeof (UINT16))) {\r
           Pointer = &Sd->mLeft[*Pointer];\r
         }\r
 \r
@@ -491,6 +517,13 @@ Returns:
 \r
   Number = (UINT16) GetBits (Sd, nbit);\r
 \r
+  if ((Number > sizeof (Sd->mPTLen)) || (nn > sizeof (Sd->mPTLen))) {\r
+    //\r
+    // Fail if Number or nn is greater than size of mPTLen\r
+    //\r
+    return (UINT16) BAD_TABLE;\r
+  }\r
+\r
   if (Number == 0) {\r
     CharC = (UINT16) GetBits (Sd, nbit);\r
 \r
@@ -526,6 +559,12 @@ Returns:
     if (Index == Special) {\r
       CharC = (UINT16) GetBits (Sd, 2);\r
       while ((INT16) (--CharC) >= 0) {\r
+        if (Index >= sizeof (Sd->mPTLen)) {\r
+          //\r
+          // Fail if Index is greater than or equal to mPTLen\r
+          //\r
+          return (UINT16) BAD_TABLE;\r
+        }\r
         Sd->mPTLen[Index++] = 0;\r
       }\r
     }\r
@@ -786,7 +825,7 @@ Arguments:
 \r
 Returns:\r
 \r
-  EFI_SUCCESS           - The size of destination buffer and the size of scratch buffer are successull retrieved.\r
+  EFI_SUCCESS           - The size of destination buffer and the size of scratch buffer are successfully retrieved.\r
   EFI_INVALID_PARAMETER - The source data is corrupted\r
 \r
 --*/\r
@@ -955,7 +994,7 @@ Arguments:
 \r
 Returns:\r
 \r
-  EFI_SUCCESS           - The size of destination buffer and the size of scratch buffer are successull retrieved.\r
+  EFI_SUCCESS           - The size of destination buffer and the size of scratch buffer are successfully retrieved.\r
   EFI_INVALID_PARAMETER - The source data is corrupted\r
 \r
 --*/\r
@@ -1041,7 +1080,7 @@ Arguments:
 \r
 Returns:\r
 \r
-  EFI_SUCCESS           - The size of destination buffer and the size of scratch buffer are successull retrieved.\r
+  EFI_SUCCESS           - The size of destination buffer and the size of scratch buffer are successfully retrieved.\r
   EFI_INVALID_PARAMETER - The source data is corrupted\r
 \r
 --*/\r