Add some security check.

[mirror_edk2.git] / MdeModulePkg / Universal / SetupBrowserDxe / Setup.c

diff --git a/MdeModulePkg/Universal/SetupBrowserDxe/Setup.c b/MdeModulePkg/Universal/SetupBrowserDxe/Setup.c
index 36ed98c9988f0b45e1f715103185083b4f377e24..81de737a03a9301671f49c19b6f0edb51c6253af 100644 (file)
--- a/MdeModulePkg/Universal/SetupBrowserDxe/Setup.c
+++ b/MdeModulePkg/Universal/SetupBrowserDxe/Setup.c
@@ -1138,11 +1138,13 @@ GetQuestionValue (
       //\r
       CopyMem (Dst, Storage->EditBuffer + Question->VarStoreInfo.VarOffset, StorageWidth);\r
     } else {\r
+      Value = NULL;\r
       Status = GetValueByName (Storage, Question->VariableName, &Value);\r
       if (EFI_ERROR (Status)) {\r
         return Status;\r
       }\r
 \r
+      ASSERT (Value != NULL);\r
       LengthStr = StrLen (Value);\r
       Status    = EFI_SUCCESS;\r
       if (IsString) {\r
@@ -2461,18 +2463,23 @@ GetIfrBinaryData (
             break;\r
           }\r
 \r
-          //\r
-          // Try to compare against formset class GUID\r
-          //\r
-          NumberOfClassGuid = (UINT8) (((EFI_IFR_FORM_SET *) OpCodeData)->Flags & 0x3);\r
-          ClassGuid         = (EFI_GUID *) (OpCodeData + sizeof (EFI_IFR_FORM_SET));\r
-          for (Index = 0; Index < NumberOfClassGuid; Index++) {\r
-            if (CompareGuid (ComparingGuid, ClassGuid + Index)) {\r
-              ClassGuidMatch = TRUE;\r
+          if (((EFI_IFR_OP_HEADER *) OpCodeData)->Length > OFFSET_OF (EFI_IFR_FORM_SET, Flags)) {\r
+            //\r
+            // Try to compare against formset class GUID\r
+            //\r
+            NumberOfClassGuid = (UINT8) (((EFI_IFR_FORM_SET *) OpCodeData)->Flags & 0x3);\r
+            ClassGuid         = (EFI_GUID *) (OpCodeData + sizeof (EFI_IFR_FORM_SET));\r
+            for (Index = 0; Index < NumberOfClassGuid; Index++) {\r
+              if (CompareGuid (ComparingGuid, ClassGuid + Index)) {\r
+                ClassGuidMatch = TRUE;\r
+                break;\r
+              }\r
+            }\r
+            if (ClassGuidMatch) {\r
               break;\r
             }\r
-          }\r
-          if (ClassGuidMatch) {\r
+          } else if (ComparingGuid == &gEfiHiiPlatformSetupFormsetGuid) {\r
+            ClassGuidMatch = TRUE;\r
             break;\r
           }\r
         }\r