Add more checking to avoid the buffer overflow.

[mirror_edk2.git] / IntelFrameworkModulePkg / Library / GenericBdsLib / BdsConsole.c

diff --git a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
index 30a6c3e6ed6a6a9e2b9db7f826493504bc11ef01..0eadec9fe7effd559be2f90b57ca167ee50ade52 100644 (file)
--- a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
+++ b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
@@ -41,6 +41,10 @@ IsNvNeed (
     Ptr++;\r
   }\r
 \r
+  if ((((UINTN)Ptr - (UINTN)ConVarName) / sizeof (CHAR16)) <= 3) {\r
+    return TRUE;\r
+  }\r
+  \r
   if ((*(Ptr - 3) == 'D') && (*(Ptr - 2) == 'e') && (*(Ptr - 1) == 'v')) {\r
     return FALSE;\r
   } else {\r
@@ -60,8 +64,12 @@ IsNvNeed (
                              On OUT, new console hanlde in system table.\r
   @param  ProtocolInterface  On IN,  console protocol on console handle in System Table to be checked. \r
                              On OUT, new console protocol on new console hanlde in system table.\r
+\r
+  @retval TRUE               System Table has been updated.\r
+  @retval FALSE              System Table hasn't been updated.\r
+\r
 **/\r
-VOID \r
+BOOLEAN \r
 UpdateSystemTableConsole (\r
   IN     CHAR16                          *VarName,\r
   IN     EFI_GUID                        *ConsoleGuid,\r
@@ -93,7 +101,7 @@ UpdateSystemTableConsole (
       // If ConsoleHandle is valid and console protocol on this handle also\r
       // also matched, just return.\r
       //\r
-      return;\r
+      return FALSE;\r
     }\r
   }\r
   \r
@@ -109,7 +117,7 @@ UpdateSystemTableConsole (
     //\r
     // If there is no any console device, just return.\r
     //\r
-    return ;\r
+    return FALSE;\r
   }\r
 \r
   FullDevicePath = VarConsole;\r
@@ -147,7 +155,7 @@ UpdateSystemTableConsole (
         //\r
         *ConsoleHandle     = NewHandle;\r
         *ProtocolInterface = Interface;\r
-        return ;\r
+        return TRUE;\r
       }\r
     }\r
 \r
@@ -156,7 +164,7 @@ UpdateSystemTableConsole (
   //\r
   // No any available console devcie found.\r
   //\r
-  ASSERT (FALSE);  \r
+  return FALSE;\r
 }\r
 \r
 /**\r
@@ -485,6 +493,7 @@ BdsLibConnectAllDefaultConsoles (
   )\r
 {\r
   EFI_STATUS                Status;\r
+  BOOLEAN                   SystemTableUpdated;\r
 \r
   //\r
   // Connect all default console variables\r
@@ -517,12 +526,31 @@ BdsLibConnectAllDefaultConsoles (
   //\r
   BdsLibConnectConsoleVariable (L"ErrOut");\r
 \r
+  SystemTableUpdated = FALSE;\r
   //\r
   // Fill console handles in System Table if no console device assignd.\r
   //\r
-  UpdateSystemTableConsole (L"ConIn", &gEfiSimpleTextInProtocolGuid, &gST->ConsoleInHandle, (VOID **) &gST->ConIn);\r
-  UpdateSystemTableConsole (L"ConOut", &gEfiSimpleTextOutProtocolGuid, &gST->ConsoleOutHandle, (VOID **) &gST->ConOut);\r
-  UpdateSystemTableConsole (L"ErrOut", &gEfiSimpleTextOutProtocolGuid, &gST->StandardErrorHandle, (VOID **) &gST->StdErr);\r
+  if (UpdateSystemTableConsole (L"ConIn", &gEfiSimpleTextInProtocolGuid, &gST->ConsoleInHandle, (VOID **) &gST->ConIn)) {\r
+    SystemTableUpdated = TRUE;\r
+  }\r
+  if (UpdateSystemTableConsole (L"ConOut", &gEfiSimpleTextOutProtocolGuid, &gST->ConsoleOutHandle, (VOID **) &gST->ConOut)) {\r
+    SystemTableUpdated = TRUE;\r
+  }\r
+  if (UpdateSystemTableConsole (L"ErrOut", &gEfiSimpleTextOutProtocolGuid, &gST->StandardErrorHandle, (VOID **) &gST->StdErr)) {\r
+    SystemTableUpdated = TRUE;\r
+  }\r
+\r
+  if (SystemTableUpdated) {\r
+    //\r
+    // Update the CRC32 in the EFI System Table header\r
+    //\r
+    gST->Hdr.CRC32 = 0;\r
+    gBS->CalculateCrc32 (\r
+          (UINT8 *) &gST->Hdr,\r
+          gST->Hdr.HeaderSize,\r
+          &gST->Hdr.CRC32\r
+          );\r
+  }\r
 \r
   return EFI_SUCCESS;\r
 \r
@@ -563,7 +591,7 @@ ConvertBmpToGopBlt (
   BMP_COLOR_MAP                 *BmpColorMap;\r
   EFI_GRAPHICS_OUTPUT_BLT_PIXEL *BltBuffer;\r
   EFI_GRAPHICS_OUTPUT_BLT_PIXEL *Blt;\r
-  UINTN                         BltBufferSize;\r
+  UINT64                        BltBufferSize;\r
   UINTN                         Index;\r
   UINTN                         Height;\r
   UINTN                         Width;\r
@@ -599,12 +627,19 @@ ConvertBmpToGopBlt (
   // Calculate the BltBuffer needed size.\r
   //\r
   BltBufferSize = BmpHeader->PixelWidth * BmpHeader->PixelHeight * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL);\r
+  if (BltBufferSize >= SIZE_4GB) {\r
+    //\r
+    // If the BMP resolution is too large\r
+    //\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+  \r
   IsAllocated   = FALSE;\r
   if (*GopBlt == NULL) {\r
     //\r
     // GopBlt is not allocated by caller.\r
     //\r
-    *GopBltSize = BltBufferSize;\r
+    *GopBltSize = (UINTN) BltBufferSize;\r
     *GopBlt     = AllocatePool (*GopBltSize);\r
     IsAllocated = TRUE;\r
     if (*GopBlt == NULL) {\r
@@ -614,8 +649,8 @@ ConvertBmpToGopBlt (
     //\r
     // GopBlt has been allocated by caller.\r
     //\r
-    if (*GopBltSize < BltBufferSize) {\r
-      *GopBltSize = BltBufferSize;\r
+    if (*GopBltSize < (UINTN) BltBufferSize) {\r
+      *GopBltSize = (UINTN) BltBufferSize;\r
       return EFI_BUFFER_TOO_SMALL;\r
     }\r
   }\r