Update for code security.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@7255 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Bus/Usb/UsbKbDxe/KeyBoard.c b/MdeModulePkg/Bus/Usb/UsbKbDxe/KeyBoard.c
index 79598c5a01dc002b95d15299d824b637ad75e73e..3c72822a6deb7a001adbe962566e03966e59fcf6 100644 (file)
--- a/MdeModulePkg/Bus/Usb/UsbKbDxe/KeyBoard.c
+++ b/MdeModulePkg/Bus/Usb/UsbKbDxe/KeyBoard.c
@@ -1161,6 +1161,8 @@ KeyboardHandler (
       // Handle repeat key\r
       //\r
       KeyDescriptor = GetKeyDescriptor (UsbKeyboardDevice, CurKeyCodeBuffer[Index]);\r
+      ASSERT (KeyDescriptor != NULL);\r
+\r
       if (KeyDescriptor->Modifier == EFI_NUM_LOCK_MODIFIER || KeyDescriptor->Modifier == EFI_CAPS_LOCK_MODIFIER) {\r
         //\r
         // For NumLock or CapsLock pressed, there is no need to handle repeat key for them.\r
@@ -1302,6 +1304,8 @@ USBParseKey (
     RemoveKeyCode (&(UsbKeyboardDevice->KeyboardBuffer), &UsbKey);\r
 \r
     KeyDescriptor = GetKeyDescriptor (UsbKeyboardDevice, UsbKey.KeyCode);\r
+    ASSERT (KeyDescriptor != NULL);\r
+\r
     if (!UsbKey.Down) {\r
       //\r
       // Key is released.\r
@@ -1546,6 +1550,7 @@ USBParseKey (
   @retval EFI_INVALID_PARAMETER KeyCode is not in the range of 0x4 to 0x65.\r
   @retval EFI_INVALID_PARAMETER Translated EFI_INPUT_KEY has zero for both ScanCode and UnicodeChar.\r
   @retval EFI_NOT_READY         KeyCode represents a dead key with EFI_NS_KEY_MODIFIER\r
+  @retval EFI_DEVICE_ERROR      Keyboard layout is invalid.\r
 \r
 **/\r
 EFI_STATUS\r
@@ -1569,6 +1574,7 @@ UsbKeyCodeToEfiInputKey (
   }\r
 \r
   KeyDescriptor = GetKeyDescriptor (UsbKeyboardDevice, KeyCode);\r
+  ASSERT (KeyDescriptor != NULL);\r
 \r
   if (KeyDescriptor->Modifier == EFI_NS_KEY_MODIFIER) {\r
     //\r
@@ -1587,6 +1593,13 @@ UsbKeyCodeToEfiInputKey (
     UsbKeyboardDevice->CurrentNsKey = NULL;\r
   }\r
 \r
+  //\r
+  // Make sure modifier of Key Descriptor is in the valid range according to UEFI spec.\r
+  //\r
+  if (KeyDescriptor->Modifier > EFI_FUNCTION_KEY_TWELVE_MODIFIER) {\r
+    return EFI_DEVICE_ERROR;\r
+  }\r
+\r
   Key->ScanCode = ModifierValueToEfiScanCodeConvertionTable[KeyDescriptor->Modifier];\r
   Key->UnicodeChar = KeyDescriptor->Unicode;\r
 \r
@@ -1804,6 +1817,8 @@ InsertKeyCode (
     RemoveKeyCode (KeyboardBuffer, &UsbKey);\r
   }\r
 \r
+  ASSERT (KeyboardBuffer->BufferTail <= MAX_KEY_ALLOWED);\r
+\r
   KeyboardBuffer->Buffer[KeyboardBuffer->BufferTail].KeyCode = Key;\r
   KeyboardBuffer->Buffer[KeyboardBuffer->BufferTail].Down    = Down;\r
 \r
@@ -1835,6 +1850,8 @@ RemoveKeyCode (
     return EFI_DEVICE_ERROR;\r
   }\r
 \r
+  ASSERT (KeyboardBuffer->BufferHead <= MAX_KEY_ALLOWED);\r
+\r
   UsbKey->KeyCode = KeyboardBuffer->Buffer[KeyboardBuffer->BufferHead].KeyCode;\r
   UsbKey->Down    = KeyboardBuffer->Buffer[KeyboardBuffer->BufferHead].Down;\r
 \r

diff --git a/MdeModulePkg/Bus/Usb/UsbKbDxe/KeyBoard.h b/MdeModulePkg/Bus/Usb/UsbKbDxe/KeyBoard.h
index aab3d24e67f263048a1fbe4ee824e7b26516ee28..60ebee1daafcf47ccd374e80077238919d0a0a64 100644 (file)
--- a/MdeModulePkg/Bus/Usb/UsbKbDxe/KeyBoard.h
+++ b/MdeModulePkg/Bus/Usb/UsbKbDxe/KeyBoard.h
@@ -161,6 +161,7 @@ USBParseKey (
   @retval EFI_INVALID_PARAMETER KeyCode is not in the range of 0x4 to 0x65.\r
   @retval EFI_INVALID_PARAMETER Translated EFI_INPUT_KEY has zero for both ScanCode and UnicodeChar.\r
   @retval EFI_NOT_READY         KeyCode represents a dead key with EFI_NS_KEY_MODIFIER\r
+  @retval EFI_DEVICE_ERROR      Keyboard layout is invalid.\r
 \r
 **/\r
 EFI_STATUS\r

diff --git a/MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassImpl.c b/MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassImpl.c
index 0db4c143560662596a94183ce49590635286f5e9..15fdad573d91f2c151175f2ba098cba47e5d2e67 100644 (file)
--- a/MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassImpl.c
+++ b/MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassImpl.c
@@ -596,10 +596,10 @@ UsbMassInitMultiLun (
   return EFI_SUCCESS;\r
 \r
 ON_ERROR:\r
-  if (UsbMass->DevicePath != NULL) {\r
-    FreePool (UsbMass->DevicePath);\r
-  }\r
   if (UsbMass != NULL) {\r
+    if (UsbMass->DevicePath != NULL) {\r
+      FreePool (UsbMass->DevicePath);\r
+    }\r
     FreePool (UsbMass);\r
   }\r
   if (UsbIo != NULL) {\r

diff --git a/MdeModulePkg/Library/DxePlatDriOverLib/PlatDriOverLib.c b/MdeModulePkg/Library/DxePlatDriOverLib/PlatDriOverLib.c
index 81570a2111deb7ed778be24bb987051a4719b2f3..f2aad41e7a4229479233cf51ebdb86f8b2b8af0e 100644 (file)
--- a/MdeModulePkg/Library/DxePlatDriOverLib/PlatDriOverLib.c
+++ b/MdeModulePkg/Library/DxePlatDriOverLib/PlatDriOverLib.c
@@ -1800,6 +1800,8 @@ ConnectDevicePath (
     // After this call DevicePath points to the next Instance\r
     //\r
     Instance  = GetNextDevicePathInstance (&DevicePath, &Size);\r
+    ASSERT (Instance != NULL);\r
+\r
     Next      = Instance;\r
     while (!IsDevicePathEndType (Next)) {\r
       Next = NextDevicePathNode (Next);\r