From: klu2 <klu2@6f19259b-4bc3-4df7-8a09-765794883524>
Date: Tue, 23 Jun 2009 09:36:17 +0000 (+0000)
Subject: Fix some potential buffer overflow issue.
X-Git-Tag: edk2-stable201903~17678
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=582c23689f1d8494d42d791c858cbe559d243b04

Fix some potential buffer overflow issue.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@8629 6f19259b-4bc3-4df7-8a09-765794883524
---

diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c
index dcc1fe2a13..6e5d61c4c4 100644
--- a/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c
+++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BootMaint/UpdatePage.c
@@ -459,8 +459,8 @@ UpdateConsolePage (
 
   UpdatePageStart (CallbackData);
 
-  ASSERT (ConsoleMenu->MenuNumber <= (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (CallbackData->BmmFakeNvData.ConsoleCheck[0])));
-  for (Index = 0; Index < ConsoleMenu->MenuNumber; Index++) {
+  for (Index = 0; ((Index < ConsoleMenu->MenuNumber) && \
+       (Index < (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (UINT8)))) ; Index++) {
     NewMenuEntry      = BOpt_GetMenuEntry (ConsoleMenu, Index);
     NewConsoleContext = (BM_CONSOLE_CONTEXT *) NewMenuEntry->VariableContext;
     CheckFlags        = 0;
@@ -484,7 +484,8 @@ UpdateConsolePage (
       );
   }
 
-  for (Index2 = 0; Index2 < TerminalMenu.MenuNumber; Index2++) {
+  for (Index2 = 0; ((Index2 < TerminalMenu.MenuNumber) && \
+       (Index2 < (sizeof (CallbackData->BmmFakeNvData.ConsoleCheck) / sizeof (UINT8)))); Index2++) {
     CheckFlags          = 0;
     NewMenuEntry        = BOpt_GetMenuEntry (&TerminalMenu, Index2);
     NewTerminalContext  = (BM_TERMINAL_CONTEXT *) NewMenuEntry->VariableContext;
@@ -548,7 +549,8 @@ UpdateOrderPage (
   OptionsOpCodeHandle = HiiAllocateOpCodeHandle ();
   ASSERT (OptionsOpCodeHandle != NULL);
   
-  for (Index = 0; Index < OptionMenu->MenuNumber; Index++) {
+  for (Index = 0; ((Index < OptionMenu->MenuNumber) && \
+       (Index < (sizeof (CallbackData->BmmFakeNvData.OptionOrder) / sizeof (UINT8))))); Index++) {
     NewMenuEntry = BOpt_GetMenuEntry (OptionMenu, Index);
     HiiCreateOneOfOptionOpCode (
       OptionsOpCodeHandle,