Add array index check to avoid potential buffer overflow.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@10179 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/UefiCpuPkg/CpuDxe/CpuDxe.c b/UefiCpuPkg/CpuDxe/CpuDxe.c
index e117b9ab56f0c3c14d736a93b71bcca56968dd53..457823d5cd427dc4bfe9ef92a256f50eab8029ff 100644 (file)
--- a/UefiCpuPkg/CpuDxe/CpuDxe.c
+++ b/UefiCpuPkg/CpuDxe/CpuDxe.c
@@ -857,6 +857,7 @@ RefreshGcdMemoryAttributes (
   UINT32                              FirmwareVariableMtrrCount;\r
 \r
   FirmwareVariableMtrrCount = GetFirmwareVariableMtrrCount ();\r
+  ASSERT (FirmwareVariableMtrrCount <= MTRR_NUMBER_OF_VARIABLE_MTRR);\r
 \r
 //  mIsFlushingGCD = TRUE;\r
   mIsFlushingGCD = FALSE;\r

diff --git a/UefiCpuPkg/Library/MtrrLib/MtrrLib.c b/UefiCpuPkg/Library/MtrrLib/MtrrLib.c
index 3c3115c8a006a29b5f81dcd47672c3022d6674c8..4e6878f2825333910d1ee23df8dedb1c485eeeaa 100644 (file)
--- a/UefiCpuPkg/Library/MtrrLib/MtrrLib.c
+++ b/UefiCpuPkg/Library/MtrrLib/MtrrLib.c
@@ -1156,6 +1156,8 @@ MtrrGetMemoryAttribute (
   // Go through the variable MTRR\r
   //\r
   VariableMtrrCount = GetVariableMtrrCount ();\r
+  ASSERT (VariableMtrrCount <= MTRR_NUMBER_OF_VARIABLE_MTRR);\r
+\r
   for (Index = 0; Index < VariableMtrrCount; Index++) {\r
     if (VariableMtrr[Index].Valid) {\r
       if (Address >= VariableMtrr[Index].BaseAddress &&\r
@@ -1189,6 +1191,8 @@ MtrrGetVariableMtrr (
   UINT32  VariableMtrrCount;\r
 \r
   VariableMtrrCount = GetVariableMtrrCount ();\r
+  ASSERT (VariableMtrrCount <= MTRR_NUMBER_OF_VARIABLE_MTRR);\r
+\r
   for (Index = 0; Index < VariableMtrrCount; Index++) {\r
     VariableSettings->Mtrr[Index].Base =\r
       AsmReadMsr64 (MTRR_LIB_IA32_VARIABLE_MTRR_BASE + (Index << 1));\r
@@ -1215,6 +1219,8 @@ MtrrSetVariableMtrrWorker (
   UINT32  VariableMtrrCount;\r
 \r
   VariableMtrrCount = GetVariableMtrrCount ();\r
+  ASSERT (VariableMtrrCount <= MTRR_NUMBER_OF_VARIABLE_MTRR);\r
+\r
   for (Index = 0; Index < VariableMtrrCount; Index++) {\r
     AsmWriteMsr64 (\r
       MTRR_LIB_IA32_VARIABLE_MTRR_BASE + (Index << 1),\r