Fix memory out of band access in AsmFxSave() and AsmFxRestore().

Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13894 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdePkg/Library/BaseLib/X86FxRestore.c b/MdePkg/Library/BaseLib/X86FxRestore.c
index d93cc91df3f6b7629a21f70090d47cbf2c99acc3..b2a02fe25f981b7dfe0c59f77e941aeebfab92b1 100644 (file)
--- a/MdePkg/Library/BaseLib/X86FxRestore.c
+++ b/MdePkg/Library/BaseLib/X86FxRestore.c
@@ -1,7 +1,7 @@
 /** @file\r
   IA-32/x64 AsmFxRestore()\r
 \r
-  Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r
@@ -43,7 +43,7 @@ AsmFxRestore (
   //\r
   // Check the flag recorded by AsmFxSave()\r
   //\r
-  ASSERT (0xAA5555AA == *(UINT32 *) (&Buffer[sizeof (IA32_FX_BUFFER) - 4]));\r
+  ASSERT (0xAA5555AA == *(UINT32 *) (&Buffer->Buffer[sizeof (Buffer->Buffer) - 4]));\r
 \r
   InternalX86FxRestore (Buffer);\r
 }\r

diff --git a/MdePkg/Library/BaseLib/X86FxSave.c b/MdePkg/Library/BaseLib/X86FxSave.c
index 2dc935079e6e32858772a17637fd21669cd32e0b..0a40bcc2c4cbed08e5c9df9c97542d43d83b6f01 100644 (file)
--- a/MdePkg/Library/BaseLib/X86FxSave.c
+++ b/MdePkg/Library/BaseLib/X86FxSave.c
@@ -1,7 +1,7 @@
 /** @file\r
   IA-32/x64 AsmFxSave()\r
 \r
-  Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r
@@ -44,5 +44,5 @@ AsmFxSave (
   //\r
   // Mark one flag at end of Buffer, it will be check by AsmFxRestor()\r
   //\r
-  *(UINT32 *) (&Buffer[sizeof (IA32_FX_BUFFER) - 4]) = 0xAA5555AA;\r
+  *(UINT32 *) (&Buffer->Buffer[sizeof (Buffer->Buffer) - 4]) = 0xAA5555AA;\r
 }\r