SignedCapsulePkg: Address NULL pointer dereference case.

Original code GetFmpImageDescriptors for OriginalFmpImageInfoBuf
pointer, if failed, return a NULL pointer. The OriginalFmpImageInfoBuf
should not be NULL and the NULL pointer dereference case
should be false positive.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Signed-off-by: Vin Xue <vinxue@outlook.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/SignedCapsulePkg/Universal/SystemFirmwareUpdate/SystemFirmwareUpdateDxe.c b/SignedCapsulePkg/Universal/SystemFirmwareUpdate/SystemFirmwareUpdateDxe.c
index bdb70bdb32cc1ec8df0984a497ad325ad50fe0f1..ea795cd7db58a805c21954b0666c39164a0c14a4 100644 (file)
--- a/SignedCapsulePkg/Universal/SystemFirmwareUpdate/SystemFirmwareUpdateDxe.c
+++ b/SignedCapsulePkg/Universal/SystemFirmwareUpdate/SystemFirmwareUpdateDxe.c
@@ -681,32 +681,35 @@ FindMatchingFmpHandles (
     //\r
     // Loop through the set of EFI_FIRMWARE_IMAGE_DESCRIPTORs.\r
     //\r
-    FmpImageInfoBuf = OriginalFmpImageInfoBuf;\r
     MatchFound = FALSE;\r
-    for (Index2 = 0; Index2 < FmpImageInfoCount; Index2++) {\r
-      for (Index3 = 0; Index3 < mSystemFmpPrivate->DescriptorCount; Index3++) {\r
-        MatchFound = CompareGuid (\r
-                       &FmpImageInfoBuf->ImageTypeId,\r
-                       &mSystemFmpPrivate->ImageDescriptor[Index3].ImageTypeId\r
-                       );\r
+    if (OriginalFmpImageInfoBuf != NULL) {\r
+      FmpImageInfoBuf = OriginalFmpImageInfoBuf;\r
+\r
+      for (Index2 = 0; Index2 < FmpImageInfoCount; Index2++) {\r
+        for (Index3 = 0; Index3 < mSystemFmpPrivate->DescriptorCount; Index3++) {\r
+          MatchFound = CompareGuid (\r
+                        &FmpImageInfoBuf->ImageTypeId,\r
+                        &mSystemFmpPrivate->ImageDescriptor[Index3].ImageTypeId\r
+                        );\r
+          if (MatchFound) {\r
+            break;\r
+          }\r
+        }\r
         if (MatchFound) {\r
           break;\r
         }\r
+        //\r
+        // Increment the buffer pointer ahead by the size of the descriptor\r
+        //\r
+        FmpImageInfoBuf = (EFI_FIRMWARE_IMAGE_DESCRIPTOR *)(((UINT8 *)FmpImageInfoBuf) + DescriptorSize);\r
       }\r
       if (MatchFound) {\r
-        break;\r
+        HandleBuffer[*HandleCount] = HandleBuffer[Index];\r
+        (*HandleCount)++;\r
       }\r
-      //\r
-      // Increment the buffer pointer ahead by the size of the descriptor\r
-      //\r
-      FmpImageInfoBuf = (EFI_FIRMWARE_IMAGE_DESCRIPTOR *)(((UINT8 *)FmpImageInfoBuf) + DescriptorSize);\r
-    }\r
-    if (MatchFound) {\r
-      HandleBuffer[*HandleCount] = HandleBuffer[Index];\r
-      (*HandleCount)++;\r
-    }\r
 \r
-    FreePool (OriginalFmpImageInfoBuf);\r
+      FreePool (OriginalFmpImageInfoBuf);\r
+    }\r
   }\r
 \r
   if ((*HandleCount) == 0) {\r