Fix some potential buffer overflow issue.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@8629 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c
index dcc1fe2a13e6f442c4566173379e2159740ff3ac..6e5d61c4c4d5a161c84df4cef0c5749aec298045 100644 (file)
--- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c
+++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c
@@ -459,8 +459,8 @@ UpdateConsolePage (
 \r
   UpdatePageStart (CallbackData);\r
 \r
 \r
   UpdatePageStart (CallbackData);\r
 \r

-  ASSERT (ConsoleMenu->MenuNumber <= (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (CallbackData->BmmFakeNvData.ConsoleCheck[0])));\r
-  for (Index = 0; Index < ConsoleMenu->MenuNumber; Index++) {\r
+  for (Index = 0; ((Index < ConsoleMenu->MenuNumber) && \\r
+       (Index < (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (UINT8)))) ; Index++) {\r

     NewMenuEntry      = BOpt_GetMenuEntry (ConsoleMenu, Index);\r
     NewConsoleContext = (BM_CONSOLE_CONTEXT *) NewMenuEntry->VariableContext;\r
     CheckFlags        = 0;\r
     NewMenuEntry      = BOpt_GetMenuEntry (ConsoleMenu, Index);\r
     NewConsoleContext = (BM_CONSOLE_CONTEXT *) NewMenuEntry->VariableContext;\r
     CheckFlags        = 0;\r


@@ -484,7 +484,8 @@ UpdateConsolePage (
       );\r
   }\r
 \r
       );\r
   }\r
 \r

-  for (Index2 = 0; Index2 < TerminalMenu.MenuNumber; Index2++) {\r
+  for (Index2 = 0; ((Index2 < TerminalMenu.MenuNumber) && \\r
+       (Index2 < (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (UINT8)))); Index2++) {\r

     CheckFlags          = 0;\r
     NewMenuEntry        = BOpt_GetMenuEntry (&TerminalMenu, Index2);\r
     NewTerminalContext  = (BM_TERMINAL_CONTEXT *) NewMenuEntry->VariableContext;\r
     CheckFlags          = 0;\r
     NewMenuEntry        = BOpt_GetMenuEntry (&TerminalMenu, Index2);\r
     NewTerminalContext  = (BM_TERMINAL_CONTEXT *) NewMenuEntry->VariableContext;\r


@@ -548,7 +549,8 @@ UpdateOrderPage (
   OptionsOpCodeHandle = HiiAllocateOpCodeHandle ();\r
   ASSERT (OptionsOpCodeHandle != NULL);\r
   \r
   OptionsOpCodeHandle = HiiAllocateOpCodeHandle ();\r
   ASSERT (OptionsOpCodeHandle != NULL);\r
   \r

-  for (Index = 0; Index < OptionMenu->MenuNumber; Index++) {\r
+  for (Index = 0; ((Index < OptionMenu->MenuNumber) && \\r
+       (Index < (sizeof (CallbackData->BmmFakeNvData.OptionOrder) / sizeof (UINT8))))); Index++) {\r

     NewMenuEntry = BOpt_GetMenuEntry (OptionMenu, Index);\r
     HiiCreateOneOfOptionOpCode (\r
       OptionsOpCodeHandle,\r
     NewMenuEntry = BOpt_GetMenuEntry (OptionMenu, Index);\r
     HiiCreateOneOfOptionOpCode (\r
       OptionsOpCodeHandle,\r