Enhanced BMP file security check.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@9010 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/EdkCompatibilityPkg/Foundation/Library/Dxe/Graphics/Graphics.c b/EdkCompatibilityPkg/Foundation/Library/Dxe/Graphics/Graphics.c
index 61929d5bd9953c1d9b1ff66c9e8b0c6dccd59bbc..0844a6f30dd6a6b2248bf4e7b12ddb4d794750f3 100644 (file)
--- a/EdkCompatibilityPkg/Foundation/Library/Dxe/Graphics/Graphics.c
+++ b/EdkCompatibilityPkg/Foundation/Library/Dxe/Graphics/Graphics.c
@@ -1,6 +1,6 @@
 /*++\r
 \r
-Copyright (c) 2004 - 2007, Intel Corporation                                                         \r
+Copyright (c) 2004 - 2009, Intel Corporation                                                         \r
 All rights reserved. This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -157,7 +157,7 @@ Returns:
   BMP_COLOR_MAP                 *BmpColorMap;\r
   EFI_GRAPHICS_OUTPUT_BLT_PIXEL *BltBuffer;\r
   EFI_GRAPHICS_OUTPUT_BLT_PIXEL *Blt;\r
-  UINTN                         BltBufferSize;\r
+  UINT64                        BltBufferSize;\r
   UINTN                         Index;\r
   UINTN                         Height;\r
   UINTN                         Width;\r
@@ -185,18 +185,26 @@ Returns:
   Image         = ((UINT8 *) BmpImage) + BmpHeader->ImageOffset;\r
   ImageHeader   = Image;\r
 \r
-  BltBufferSize = BmpHeader->PixelWidth * BmpHeader->PixelHeight * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL);\r
+  BltBufferSize = MultU64x32 ((UINT64) BmpHeader->PixelWidth, BmpHeader->PixelHeight);\r
+  //\r
+  // Ensure the BltBufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) doesn't overflow\r
+  //\r
+  if (BltBufferSize > DivU64x32 ((UINTN) ~0, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL), NULL)) {\r
+     return EFI_UNSUPPORTED;\r
+  }\r
+  BltBufferSize = MultU64x32 (BltBufferSize, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL));\r
+\r
   IsAllocated   = FALSE;\r
   if (*GopBlt == NULL) {\r
-    *GopBltSize = BltBufferSize;\r
+    *GopBltSize = (UINTN) BltBufferSize;\r
     *GopBlt     = EfiLibAllocatePool (*GopBltSize);\r
     IsAllocated = TRUE;\r
     if (*GopBlt == NULL) {\r
       return EFI_OUT_OF_RESOURCES;\r
     }\r
   } else {\r
-    if (*GopBltSize < BltBufferSize) {\r
-      *GopBltSize = BltBufferSize;\r
+    if (*GopBltSize < (UINTN) BltBufferSize) {\r
+      *GopBltSize = (UINTN) BltBufferSize;\r
       return EFI_BUFFER_TOO_SMALL;\r
     }\r
   }\r

diff --git a/EdkCompatibilityPkg/Foundation/Library/Dxe/GraphicsLite/Graphics.c b/EdkCompatibilityPkg/Foundation/Library/Dxe/GraphicsLite/Graphics.c
index 0f0c6f201030efbc724c805f414d97ae78886a20..739c735d92890cd01f9e91a7a0bf77b04a4d3543 100644 (file)
--- a/EdkCompatibilityPkg/Foundation/Library/Dxe/GraphicsLite/Graphics.c
+++ b/EdkCompatibilityPkg/Foundation/Library/Dxe/GraphicsLite/Graphics.c
@@ -1,6 +1,6 @@
 /*++\r
 \r
-Copyright (c) 2004 - 2006, Intel Corporation                                                         \r
+Copyright (c) 2004 - 2009, Intel Corporation                                                         \r
 All rights reserved. This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
@@ -158,7 +158,7 @@ Returns:
   BMP_COLOR_MAP                 *BmpColorMap;\r
   EFI_GRAPHICS_OUTPUT_BLT_PIXEL *BltBuffer;\r
   EFI_GRAPHICS_OUTPUT_BLT_PIXEL *Blt;\r
-  UINTN                         BltBufferSize;\r
+  UINT64                        BltBufferSize;\r
   UINTN                         Index;\r
   UINTN                         Height;\r
   UINTN                         Width;\r
@@ -186,18 +186,26 @@ Returns:
   Image         = ((UINT8 *) BmpImage) + BmpHeader->ImageOffset;\r
   ImageHeader   = Image;\r
 \r
-  BltBufferSize = BmpHeader->PixelWidth * BmpHeader->PixelHeight * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL);\r
+  BltBufferSize = MultU64x32 ((UINT64) BmpHeader->PixelWidth, BmpHeader->PixelHeight);\r
+  //\r
+  // Ensure the BltBufferSize * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) doesn't overflow\r
+  //\r
+  if (BltBufferSize > DivU64x32 ((UINTN) ~0, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL), NULL)) {\r
+     return EFI_UNSUPPORTED;\r
+  }\r
+  BltBufferSize = MultU64x32 (BltBufferSize, sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL));\r
+\r
   IsAllocated   = FALSE;\r
   if (*GopBlt == NULL) {\r
-    *GopBltSize = BltBufferSize;\r
+    *GopBltSize = (UINTN) BltBufferSize;\r
     *GopBlt     = EfiLibAllocatePool (*GopBltSize);\r
     IsAllocated = TRUE;\r
     if (*GopBlt == NULL) {\r
       return EFI_OUT_OF_RESOURCES;\r
     }\r
   } else {\r
-    if (*GopBltSize < BltBufferSize) {\r
-      *GopBltSize = BltBufferSize;\r
+    if (*GopBltSize < (UINTN) BltBufferSize) {\r
+      *GopBltSize = (UINTN) BltBufferSize;\r
       return EFI_BUFFER_TOO_SMALL;\r
     }\r
   }\r