Array 'TargetUrl' of size 255 may use index value(s) 255 and 256.
So enhance the boundary check to ensure the index is valid.
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
//\r
if ((!NET_IS_DIGIT (*(Field->Str))) && (*(Field->Str) != '[')) {\r
ConfigNvData->DnsMode = TRUE;\r
//\r
if ((!NET_IS_DIGIT (*(Field->Str))) && (*(Field->Str) != '[')) {\r
ConfigNvData->DnsMode = TRUE;\r
- if (Field->Len > sizeof (ConfigNvData->TargetUrl)) {\r
+ if ((Field->Len + 2) > sizeof (ConfigNvData->TargetUrl)) {\r
return EFI_INVALID_PARAMETER;\r
}\r
CopyMem (&ConfigNvData->TargetUrl, Field->Str, Field->Len);\r
return EFI_INVALID_PARAMETER;\r
}\r
CopyMem (&ConfigNvData->TargetUrl, Field->Str, Field->Len);\r
// Server name is expressed as domain name, just save it.\r
//\r
if (ConfigNvData->DnsMode) {\r
// Server name is expressed as domain name, just save it.\r
//\r
if (ConfigNvData->DnsMode) {\r
- if (Field->Len > sizeof (ConfigNvData->TargetUrl)) {\r
+ if ((Field->Len + 2) > sizeof (ConfigNvData->TargetUrl)) {\r
return EFI_INVALID_PARAMETER;\r
}\r
CopyMem (&ConfigNvData->TargetUrl, Field->Str, Field->Len);\r
return EFI_INVALID_PARAMETER;\r
}\r
CopyMem (&ConfigNvData->TargetUrl, Field->Str, Field->Len);\r