From 51fe5b5140ba9ecb168fb03da328983355880c7a Mon Sep 17 00:00:00 2001 From: Ruiyu Ni Date: Mon, 25 Jun 2018 15:35:06 +0800 Subject: [PATCH 1/1] MdeModulePkg/BmpSupportLib: Check PixelHeight/PixelWidth against 0 The patch adds check logic to make sure that for a input BMP file, the width or height is not 0; for a input GOP blt buffer, the width or height is not 0. Otherwise, UNSUPPORTED status is returned. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ruiyu Ni Reviewed-by: Star Zeng Cc: Michael D Kinney --- MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c b/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c index 2c23e2c61c..6196262d14 100644 --- a/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c +++ b/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c @@ -148,6 +148,11 @@ TranslateBmpToGopBlt ( return RETURN_UNSUPPORTED; } + if ((BmpHeader->PixelHeight == 0) || (BmpHeader->PixelWidth == 0)) { + DEBUG ((DEBUG_ERROR, "TranslateBmpToGopBlt: BmpHeader->PixelHeight or BmpHeader->PixelWidth is 0.\n")); + return RETURN_UNSUPPORTED; + } + // // Only support BITMAPINFOHEADER format. // BITMAPFILEHEADER + BITMAPINFOHEADER = BMP_IMAGE_HEADER @@ -484,6 +489,10 @@ TranslateGopBltToBmp ( return RETURN_INVALID_PARAMETER; } + if ((PixelHeight == 0) || (PixelWidth == 0)) { + return RETURN_UNSUPPORTED; + } + // // Allocate memory for BMP file. // -- 2.39.2