From: Ruiyu Ni <ruiyu.ni@intel.com>
Date: Mon, 25 Jun 2018 07:35:06 +0000 (+0800)
Subject: MdeModulePkg/BmpSupportLib: Check PixelHeight/PixelWidth against 0
X-Git-Tag: edk2-stable201903~1455
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=51fe5b5140ba9ecb168fb03da328983355880c7a

MdeModulePkg/BmpSupportLib: Check PixelHeight/PixelWidth against 0

The patch adds check logic to make sure that for a input BMP file,
the width or height is not 0; for a input GOP blt buffer, the width
or height is not 0. Otherwise, UNSUPPORTED status is returned.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
---

diff --git a/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c b/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c
index 2c23e2c61c..6196262d14 100644
--- a/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c
+++ b/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c
@@ -148,6 +148,11 @@ TranslateBmpToGopBlt (
     return RETURN_UNSUPPORTED;
   }
 
+  if ((BmpHeader->PixelHeight == 0) || (BmpHeader->PixelWidth == 0)) {
+    DEBUG ((DEBUG_ERROR, "TranslateBmpToGopBlt: BmpHeader->PixelHeight or BmpHeader->PixelWidth is 0.\n"));
+    return RETURN_UNSUPPORTED;
+  }
+
   //
   // Only support BITMAPINFOHEADER format.
   // BITMAPFILEHEADER + BITMAPINFOHEADER = BMP_IMAGE_HEADER
@@ -484,6 +489,10 @@ TranslateGopBltToBmp (
     return RETURN_INVALID_PARAMETER;
   }
 
+  if ((PixelHeight == 0) || (PixelWidth == 0)) {
+    return RETURN_UNSUPPORTED;
+  }
+
   //
   // Allocate memory for BMP file.
   //