MdeModulePkg BrotliDecompressLib: Add the checker to avoid array out of bound

This change is to pass static analysis.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>

diff --git a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
index fd42b3b93040491ce9eec19fa1b1c810e0764a3e..f3b3cb89711bd5a7ac9c8353ed3cd0cfd42fced9 100644 (file)
--- a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
+++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
@@ -858,6 +858,7 @@ static BROTLI_INLINE uint32_t ReadBlockLength(const HuffmanCode* table,
   uint32_t code;\r
   uint32_t nbits;\r
   code = ReadSymbol(table, br);\r
   uint32_t code;\r
   uint32_t nbits;\r
   code = ReadSymbol(table, br);\r

+  ASSERT (code < BROTLI_NUM_BLOCK_LEN_SYMBOLS);\r

   nbits = kBlockLengthPrefixCode[code].nbits;  /* nbits == 2..24 */\r
   return kBlockLengthPrefixCode[code].offset + BrotliReadBits(br, nbits);\r
 }\r
   nbits = kBlockLengthPrefixCode[code].nbits;  /* nbits == 2..24 */\r
   return kBlockLengthPrefixCode[code].offset + BrotliReadBits(br, nbits);\r
 }\r


@@ -910,6 +911,7 @@ static BROTLI_NOINLINE void InverseMoveToFrontTransform(
   uint32_t upper_bound = state->mtf_upper_bound;\r
   uint32_t* mtf = &state->mtf[1];  /* Make mtf[-1] addressable. */\r
   uint8_t* mtf_u8 = (uint8_t*)mtf;\r
   uint32_t upper_bound = state->mtf_upper_bound;\r
   uint32_t* mtf = &state->mtf[1];  /* Make mtf[-1] addressable. */\r
   uint8_t* mtf_u8 = (uint8_t*)mtf;\r

+  uint8_t* mtf_u8t = mtf_u8 - 1;\r

   /* Load endian-aware constant. */\r
   const uint8_t b0123[4] = {0, 1, 2, 3};\r
   uint32_t pattern;\r
   /* Load endian-aware constant. */\r
   const uint8_t b0123[4] = {0, 1, 2, 3};\r
   uint32_t pattern;\r


@@ -928,13 +930,13 @@ static BROTLI_NOINLINE void InverseMoveToFrontTransform(
   for (i = 0; i < v_len; ++i) {\r
     int index = v[i];\r
     uint8_t value = mtf_u8[index];\r
   for (i = 0; i < v_len; ++i) {\r
     int index = v[i];\r
     uint8_t value = mtf_u8[index];\r

-    upper_bound |= v[i];\r
+    upper_bound |= (uint32_t) v[i];\r

     v[i] = value;\r
     v[i] = value;\r

-    mtf_u8[-1] = value;\r
-    do {\r
+    mtf_u8t[0] = value;\r
+    while (index >= 0) {\r
+      mtf_u8t[index + 1] = mtf_u8t[index];\r

       index--;\r
       index--;\r

-      mtf_u8[index + 1] = mtf_u8[index];\r
-    } while (index >= 0);\r
+    }\r

   }\r
   /* Remember amount of elements to be reinitialized. */\r
   state->mtf_upper_bound = upper_bound >> 2;\r
   }\r
   /* Remember amount of elements to be reinitialized. */\r
   state->mtf_upper_bound = upper_bound >> 2;\r


@@ -1566,6 +1568,7 @@ static BROTLI_INLINE BROTLI_BOOL ReadCommandInternal(
   BrotliBitReaderState memento;\r
   if (!safe) {\r
     cmd_code = ReadSymbol(s->htree_command, br);\r
   BrotliBitReaderState memento;\r
   if (!safe) {\r
     cmd_code = ReadSymbol(s->htree_command, br);\r

+    ASSERT (cmd_code < BROTLI_NUM_COMMAND_SYMBOLS);\r

   } else {\r
     BrotliBitReaderSaveState(br, &memento);\r
     if (!SafeReadSymbol(s->htree_command, br, &cmd_code)) {\r
   } else {\r
     BrotliBitReaderSaveState(br, &memento);\r
     if (!SafeReadSymbol(s->htree_command, br, &cmd_code)) {\r