MdeModulePkg/Setup: Fix incorrect size used in AllocateCopyPool

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1115

When the type of HiiValue is EFI_IFR_TYPE_BUFFER,
its question type is EFI_IFR_ORDERED_LIST_OP.
And the buffer size allocated for Statement->BufferValue
of orderedList is "Statement->StorageWidth"
in IfrParse.c.

So here when backup the buffer value and copy the size of
"Statement->StorageWidth + sizeof(CHAR16)" is incorrect.

This patch is to fix this issue.

Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>

diff --git a/MdeModulePkg/Universal/SetupBrowserDxe/Presentation.c b/MdeModulePkg/Universal/SetupBrowserDxe/Presentation.c
index ded1c7ad1159011d893e51eeeb61e9902e36ded2..58daaab404eda0a5b66d7f5b4de13d66602107ce 100644 (file)
--- a/MdeModulePkg/Universal/SetupBrowserDxe/Presentation.c
+++ b/MdeModulePkg/Universal/SetupBrowserDxe/Presentation.c
@@ -2004,7 +2004,7 @@ ProcessCallBackFunction (
     //\r
     if (Action == EFI_BROWSER_ACTION_CHANGING) {\r
       if (HiiValue->Type == EFI_IFR_TYPE_BUFFER) {\r
-        BackUpBuffer = AllocateCopyPool(Statement->StorageWidth + sizeof(CHAR16), Statement->BufferValue);\r
+        BackUpBuffer = AllocateCopyPool(Statement->StorageWidth, Statement->BufferValue);\r
         ASSERT (BackUpBuffer != NULL);\r
       } else {\r
         CopyMem (&BackUpValue, &HiiValue->Value, sizeof (EFI_IFR_TYPE_VALUE));\r
@@ -2130,7 +2130,7 @@ ProcessCallBackFunction (
       //\r
       if (Action  == EFI_BROWSER_ACTION_CHANGING && Status == EFI_UNSUPPORTED) {\r
         if (HiiValue->Type == EFI_IFR_TYPE_BUFFER) {\r
-          CopyMem (Statement->BufferValue, BackUpBuffer, Statement->StorageWidth + sizeof(CHAR16));\r
+          CopyMem (Statement->BufferValue, BackUpBuffer, Statement->StorageWidth);\r
         } else {\r
           CopyMem (&HiiValue->Value, &BackUpValue, sizeof (EFI_IFR_TYPE_VALUE));\r
         }\r