MdeModulePkg:Fix the potential memory leak issue in Display Engine

[mirror_edk2.git] / MdeModulePkg / Universal / DisplayEngineDxe / ProcessOptions.c

diff --git a/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c b/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c
index 52dc5f29d93c7fd13e0df8c738210924790c2e01..bb2faf3244d491608544d2b95db04f58c403348e 100644 (file)
--- a/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c
+++ b/MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c
@@ -21,6 +21,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
   Concatenate a narrow string to another string.\r
 \r
   @param Destination The destination string.\r
+  @param DestMax     The Max length of destination string.\r
   @param Source      The source string. The string to be concatenated.\r
                      to the end of Destination.\r
 \r
@@ -28,6 +29,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 VOID\r
 NewStrCat (\r
   IN OUT CHAR16               *Destination,\r
+  IN     UINTN                DestMax,\r
   IN     CHAR16               *Source\r
   )\r
 {\r
@@ -45,7 +47,7 @@ NewStrCat (
   Destination[Length] = NARROW_CHAR;\r
   Length++;\r
 \r
-  StrCpy (Destination + Length, Source);\r
+  StrCpyS (Destination + Length, DestMax - Length, Source);\r
 }\r
 \r
 /**\r
@@ -566,7 +568,6 @@ PrintFormattedNumber (
 \r
   default:\r
     return EFI_UNSUPPORTED;\r
-    break;\r
   }\r
 \r
   UnicodeSPrint (FormattedNumber, BufferSize, Format, Value);\r
@@ -957,6 +958,7 @@ ProcessOptions (
   UINT8                           ValueType;\r
   EFI_IFR_ORDERED_LIST            *OrderList;\r
   BOOLEAN                         ValueInvalid;\r
+  UINTN                           MaxLen;\r
 \r
   Status        = EFI_SUCCESS;\r
 \r
@@ -999,7 +1001,8 @@ ProcessOptions (
       // We now know how many strings we will have, so we can allocate the\r
       // space required for the array or strings.\r
       //\r
-      *OptionString = AllocateZeroPool (OrderList->MaxContainers * BufferSize);\r
+      MaxLen = OrderList->MaxContainers * BufferSize / sizeof (CHAR16);\r
+      *OptionString = AllocateZeroPool (MaxLen * sizeof (CHAR16));\r
       ASSERT (*OptionString);\r
 \r
       HiiValue.Type = ValueType;\r
@@ -1057,14 +1060,14 @@ ProcessOptions (
         }\r
 \r
         Character[0] = LEFT_ONEOF_DELIMITER;\r
-        NewStrCat (OptionString[0], Character);\r
+        NewStrCat (OptionString[0], MaxLen, Character);\r
         StringPtr = GetToken (OneOfOption->OptionOpCode->Option, gFormData->HiiHandle);\r
         ASSERT (StringPtr != NULL);\r
-        NewStrCat (OptionString[0], StringPtr);\r
+        NewStrCat (OptionString[0], MaxLen, StringPtr);\r
         Character[0] = RIGHT_ONEOF_DELIMITER;\r
-        NewStrCat (OptionString[0], Character);\r
+        NewStrCat (OptionString[0], MaxLen, Character);\r
         Character[0] = CHAR_CARRIAGE_RETURN;\r
-        NewStrCat (OptionString[0], Character);\r
+        NewStrCat (OptionString[0], MaxLen, Character);\r
         FreePool (StringPtr);\r
       }\r
 \r
@@ -1092,14 +1095,14 @@ ProcessOptions (
           // Not report error, just get the correct option string info.\r
           //\r
           Character[0] = LEFT_ONEOF_DELIMITER;\r
-          NewStrCat (OptionString[0], Character);\r
+          NewStrCat (OptionString[0], MaxLen, Character);\r
           StringPtr = GetToken (OneOfOption->OptionOpCode->Option, gFormData->HiiHandle);\r
           ASSERT (StringPtr != NULL);\r
-          NewStrCat (OptionString[0], StringPtr);\r
+          NewStrCat (OptionString[0], MaxLen, StringPtr);\r
           Character[0] = RIGHT_ONEOF_DELIMITER;\r
-          NewStrCat (OptionString[0], Character);\r
+          NewStrCat (OptionString[0], MaxLen, Character);\r
           Character[0] = CHAR_CARRIAGE_RETURN;\r
-          NewStrCat (OptionString[0], Character);\r
+          NewStrCat (OptionString[0], MaxLen, Character);\r
           FreePool (StringPtr);\r
 \r
           continue;\r
@@ -1151,6 +1154,7 @@ ProcessOptions (
       //\r
       Status = GetSelectionInputPopUp (MenuOption);\r
     } else {\r
+      MaxLen = BufferSize / sizeof(CHAR16);\r
       *OptionString = AllocateZeroPool (BufferSize);\r
       ASSERT (*OptionString);\r
 \r
@@ -1204,12 +1208,12 @@ ProcessOptions (
       }\r
 \r
       Character[0] = LEFT_ONEOF_DELIMITER;\r
-      NewStrCat (OptionString[0], Character);\r
+      NewStrCat (OptionString[0], MaxLen, Character);\r
       StringPtr = GetToken (OneOfOption->OptionOpCode->Option, gFormData->HiiHandle);\r
       ASSERT (StringPtr != NULL);\r
-      NewStrCat (OptionString[0], StringPtr);\r
+      NewStrCat (OptionString[0], MaxLen, StringPtr);\r
       Character[0] = RIGHT_ONEOF_DELIMITER;\r
-      NewStrCat (OptionString[0], Character);\r
+      NewStrCat (OptionString[0], MaxLen, Character);\r
 \r
       FreePool (StringPtr);\r
     }\r