enhanced check when reading BMP file.

[mirror_edk2.git] / IntelFrameworkModulePkg / Library / GenericBdsLib / BdsConsole.c

diff --git a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
index 012fe5be047037adf0cf543758f8a3ff2c250759..a352d8084257e561bc0899887a204f8592d4690a 100644 (file)
--- a/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
+++ b/IntelFrameworkModulePkg/Library/GenericBdsLib/BdsConsole.c
@@ -629,14 +629,15 @@ ConvertBmpToGopBlt (
   //\r
   // Calculate the BltBuffer needed size.\r
   //\r
-  BltBufferSize = BmpHeader->PixelWidth * BmpHeader->PixelHeight * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL);\r
-  if (BltBufferSize >= SIZE_4GB) {\r
-    //\r
-    // If the BMP resolution is too large\r
-    //\r
-    return EFI_UNSUPPORTED;\r
-  }\r
-  \r
+  BltBufferSize = MultU64x32 ((UINT64) BmpHeader->PixelWidth, BmpHeader->PixelHeight);\r
+  //\r
+  // Ensure the BltBufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) doesn't overflow\r
+  //\r
+  if (BltBufferSize > DivU64x32 ((UINTN) ~0, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL))) {\r
+      return EFI_UNSUPPORTED;\r
+   }\r
+  BltBufferSize = MultU64x32 (BltBufferSize, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL));\r
+\r
   IsAllocated   = FALSE;\r
   if (*GopBlt == NULL) {\r
     //\r