MdeModulePkg/HiiImage: Fix stack overflow when corrupted BMP is parsed (CVE-2018... edk2-stable201903
authorRay Ni <ray.ni@intel.com>
Thu, 7 Mar 2019 10:35:14 +0000 (18:35 +0800)
committerLiming Gao <liming.gao@intel.com>
Fri, 8 Mar 2019 15:44:59 +0000 (23:44 +0800)
commit89910a39dcfd788057caa5d88b7e76e112d187b5
tree20baa1bce4e39aca5ff6e27bfa5a8a24d690bbbe
parentffe5f7a6b4e978dffbe1df228963adc914451106
MdeModulePkg/HiiImage: Fix stack overflow when corrupted BMP is parsed (CVE-2018-12181)

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1135

For 4bit BMP, there are only 2^4 = 16 colors in the palette.
But when a corrupted BMP contains more than 16 colors in the palette,
today's implementation wrongly copies all colors to the local
PaletteValue[16] array which causes stack overflow.

The similar issue also exists in the logic to handle 8bit BMP.

The patch fixes the issue by only copies the first 16 or 256 colors
in the palette depending on the BMP type.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ray Ni <ray.ni@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
MdeModulePkg/Universal/HiiDatabaseDxe/Image.c