pointer verification (not NULL) and buffer overrun fixes.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@11459 6f19259b-4bc3-4df7-8a09-765794883524

ShellPkg/Application/Shell/Shell.c

@@ -731,7 +731,7 @@ ProcessCommandLine(
     ShellInfoObject.ShellInitSettings.Delay = 0;
   } else if (ShellInfoObject.ShellInitSettings.BitUnion.Bits.Delay) {
     TempConst = ShellCommandLineGetValue(Package, L"-delay");
-    if (*TempConst == L':') {
+    if (TempConst != NULL && *TempConst == L':') {
       TempConst++;
     }
     if (TempConst != NULL && !EFI_ERROR(ShellConvertStringToUint64(TempConst, &Intermediate, FALSE, FALSE))) {

ShellPkg/Library/UefiShellDebug1CommandsLib/Bcfg.c

@@ -265,27 +265,31 @@ BcfgAddDebug1(
     FilePathSize = GetDevicePathSize (FilePath);
 
     TempByteBuffer = AllocateZeroPool(sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize);
-    TempByteStart  = TempByteBuffer;
+    if (TempByteBuffer != NULL) {
-    *((UINT32 *) TempByteBuffer) = LOAD_OPTION_ACTIVE;      // Attributes
+      TempByteStart  = TempByteBuffer;
-    TempByteBuffer += sizeof (UINT32);
+      *((UINT32 *) TempByteBuffer) = LOAD_OPTION_ACTIVE;      // Attributes
+      TempByteBuffer += sizeof (UINT32);
 
-    *((UINT16 *) TempByteBuffer) = (UINT16)FilePathSize;    // FilePathListLength
+      *((UINT16 *) TempByteBuffer) = (UINT16)FilePathSize;    // FilePathListLength
-    TempByteBuffer += sizeof (UINT16);
+      TempByteBuffer += sizeof (UINT16);
 
-    CopyMem (TempByteBuffer, Desc, DescSize);
+      CopyMem (TempByteBuffer, Desc, DescSize);
-    TempByteBuffer += DescSize;
+      TempByteBuffer += DescSize;
-    CopyMem (TempByteBuffer, FilePath, FilePathSize);
+      CopyMem (TempByteBuffer, FilePath, FilePathSize);
 
-    UnicodeSPrint (OptionStr, sizeof(OptionStr), L"%s%04x", Target == BcfgTargetBootOrder?L"Boot":L"Driver", TargetLocation);
+      UnicodeSPrint (OptionStr, sizeof(OptionStr), L"%s%04x", Target == BcfgTargetBootOrder?L"Boot":L"Driver", TargetLocation);
-    Status = gRT->SetVariable (
+      Status = gRT->SetVariable (
-          OptionStr,
+            OptionStr,
-          &gEfiGlobalVariableGuid,
+            &gEfiGlobalVariableGuid,
-          EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
+            EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
-          sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize,
+            sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize,
-          TempByteStart
+            TempByteStart
-         );
+           );
 
-    FreePool(TempByteStart);
+      FreePool(TempByteStart);
+    } else {
+      Status = EFI_OUT_OF_RESOURCES;
+    }
 
     if (EFI_ERROR(Status)) {
       ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_BCFG_SET_VAR_FAIL), gShellDebug1HiiHandle, OptionStr, Status);
@@ -385,22 +389,25 @@ BcfgRemoveDebug1(
     return (SHELL_INVALID_PARAMETER);
   }
   NewOrder = AllocateZeroPool(OrderCount*sizeof(CurrentOrder[0]));
-  NewCount = OrderCount;
+  if (NewOrder != NULL) {
-  CopyMem(NewOrder, CurrentOrder, OrderCount*sizeof(CurrentOrder[0]));
+    NewCount = OrderCount;
-  for (LoopVar = 0 ; LoopVar < OrderCount ; LoopVar++){
+    CopyMem(NewOrder, CurrentOrder, OrderCount*sizeof(CurrentOrder[0]));
-    if (NewOrder[LoopVar] == Location) {
+    for (LoopVar = 0 ; LoopVar < OrderCount ; LoopVar++){
-      CopyMem(NewOrder+LoopVar, NewOrder+LoopVar+1, (OrderCount - LoopVar - 1)*sizeof(CurrentOrder[0]));
+      if (NewOrder[LoopVar] == Location) {
-      NewCount--;
+        CopyMem(NewOrder+LoopVar, NewOrder+LoopVar+1, (OrderCount - LoopVar - 1)*sizeof(CurrentOrder[0]));
+        NewCount--;
+      }
     }
+    Status = gRT->SetVariable(
+      Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder",
+      (EFI_GUID*)&gEfiGlobalVariableGuid,
+      EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
+      NewCount*sizeof(NewOrder[0]),
+      NewOrder);
+    FreePool(NewOrder);
+  } else {
+    Status = EFI_OUT_OF_RESOURCES;
   }
-  Status = gRT->SetVariable(
-    Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder",
-    (EFI_GUID*)&gEfiGlobalVariableGuid,
-    EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
-    NewCount*sizeof(NewOrder[0]),
-    NewOrder);
-  FreePool(NewOrder);
-
   if (EFI_ERROR(Status)) {
     ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_BCFG_WRITE_FAIL), gShellDebug1HiiHandle, Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder", Status);
     return (SHELL_INVALID_PARAMETER);

ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c

@@ -247,10 +247,10 @@ MoveLine (
   // if > 0, the advance
   //
   if (Count <= 0) {
-    AbsCount  = -Count;
+    AbsCount  = (UINTN)ABS(Count);
     Line      = InternalEditorMiscLineRetreat (AbsCount,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
   } else {
-    Line = InternalEditorMiscLineAdvance (Count,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
+    Line = InternalEditorMiscLineAdvance ((UINTN)Count,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
   }
 
   return Line;
@@ -317,7 +317,7 @@ FileBufferRestoreMousePosition (
         CurrentLine = FileBuffer.CurrentLine;
         Line        = MoveLine (FRow - FileBuffer.FilePosition.Row);
 
-        if (FColumn > Line->Size) {
+        if (Line == NULL || FColumn > Line->Size) {
           HasCharacter = FALSE;
         }
 
@@ -500,7 +500,7 @@ FileBufferPrintLine (
     Limit = 0;
   }
 
-  StrnCpy (PrintLine, Buffer, Limit > MainEditor.ScreenSize.Column ? MainEditor.ScreenSize.Column : Limit);
+  StrnCpy (PrintLine, Buffer, MIN(MIN(Limit,MainEditor.ScreenSize.Column), 200));
   for (; Limit < MainEditor.ScreenSize.Column; Limit++) {
     PrintLine[Limit] = L' ';
   }
@@ -1446,7 +1446,7 @@ FileBufferSave (
   //
   // if is the old file
   //
-  if (StrCmp (FileName, FileBuffer.FileName) == 0) {
+  if (FileBuffer.FileName != NULL && StrCmp (FileName, FileBuffer.FileName) == 0) {
     //
     // file has not been modified
     //
@@ -2316,7 +2316,7 @@ FileBufferPageDown (
   //
   // if that line, is not that long, so move to the end of that line
   //
-  if (FCol > Line->Size) {
+  if (Line != NULL && FCol > Line->Size) {
     FCol = Line->Size + 1;
   }
 
@@ -2372,7 +2372,7 @@ FileBufferPageUp (
   //
   // if that line is not that long, so move to the end of that line
   //
-  if (FCol > Line->Size) {
+  if (Line != NULL && FCol > Line->Size) {
     FCol = Line->Size + 1;
   }
 
@@ -2650,10 +2650,10 @@ MoveCurrentLine (
   UINTN           AbsCount;
 
   if (Count <= 0) {
-    AbsCount  = -Count;
+    AbsCount  = (UINTN)ABS(Count);
     Line      = InternalEditorMiscLineRetreat (AbsCount,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
   } else {
-    Line = InternalEditorMiscLineAdvance (Count,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
+    Line = InternalEditorMiscLineAdvance ((UINTN)Count,MainEditor.FileBuffer->CurrentLine,MainEditor.FileBuffer->ListHead);
   }
 
   if (Line == NULL) {
@@ -2720,7 +2720,7 @@ FileBufferMovePosition (
       //
       FileBuffer.FilePosition.Row = NewFilePosRow;
       if (RowGap < 0) {
-        Abs = -RowGap;
+        Abs = (UINTN)ABS(RowGap);
         FileBuffer.DisplayPosition.Row -= Abs;
       } else {
         FileBuffer.DisplayPosition.Row += RowGap;

ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/BufferImage.c

@@ -637,7 +637,7 @@ HBufferImageRestoreMousePosition (
         CurrentLine = HBufferImage.CurrentLine;
         Line        = HMoveLine (FRow - HBufferImage.BufferPosition.Row);
 
-        if (FColumn > Line->Size) {
+        if (Line == NULL || FColumn > Line->Size) {
           HasCharacter = FALSE;
         }
 
@@ -1620,7 +1620,7 @@ Returns:
       //
       HBufferImage.BufferPosition.Row = NewFilePosRow;
       if (RowGap <= 0) {
-        Abs = -RowGap;
+        Abs = (UINTN)ABS(RowGap);
         HBufferImage.DisplayPosition.Row -= Abs;
       } else {
         HBufferImage.DisplayPosition.Row += RowGap;
@@ -1931,7 +1931,7 @@ Returns:
   //
   // if that line, is not that long, so move to the end of that line
   //
-  if (FCol > Line->Size) {
+  if (Line != NULL && FCol > Line->Size) {
     FCol      = Line->Size + 1;
     HighBits  = TRUE;
   }

ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/FileImage.c

@@ -383,7 +383,7 @@ Returns:
   //
   // if is the old file
   //
-  if (StrCmp (FileName, HFileImage.FileName) == 0) {
+  if (HFileImage.FileName != NULL && FileName != NULL && StrCmp (FileName, HFileImage.FileName) == 0) {
     //
     // check whether file exists on disk
     //

ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/HexEdit.c

@@ -110,7 +110,7 @@ ShellCommandRunHexEdit (
         ShellStatus = SHELL_INVALID_PARAMETER;
       } else {
         Name      = ShellCommandLineGetRawValue(Package, 1);
-        if (!IsValidFileName(Name)) {
+        if (Name == NULL || !IsValidFileName(Name)) {
           ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_GEN_PROBLEM), gShellDebug1HiiHandle, Name);
           ShellStatus = SHELL_INVALID_PARAMETER;
         } else {

ShellPkg/Library/UefiShellDebug1CommandsLib/HexEdit/Misc.c

@@ -256,10 +256,10 @@ Returns:
   //     do not set currentline to Line
   //
   if (Count <= 0) {
-    AbsCount  = -Count;
+    AbsCount  = (UINTN)ABS(Count);
     Line      = _HLineRetreat (AbsCount);
   } else {
-    Line = _HLineAdvance (Count);
+    Line = _HLineAdvance ((UINTN)Count);
   }
 
   return Line;
@@ -297,10 +297,10 @@ Returns:
   // >0: advance
   //
   if (Count <= 0) {
-    AbsCount  = -Count;
+    AbsCount  = (UINTN)ABS(Count);
     Line      = _HLineRetreat (AbsCount);
   } else {
-    Line = _HLineAdvance (Count);
+    Line = _HLineAdvance ((UINTN)Count);
   }
 
   if (Line == NULL) {
@@ -399,7 +399,10 @@ Returns:
   Lenp        = StrLen (Pat);
   Lens        = StrLen (Str);
 
-  Failure     = AllocateZeroPool (Lenp * sizeof (INTN));
+  Failure     = AllocateZeroPool ((UINTN)(Lenp * sizeof (INTN)));
+  if (Failure == NULL) {
+    return 0;
+  }
   Failure[0]  = -1;
   for (j = 1; j < Lenp; j++) {
     i = Failure[j - 1];

ShellPkg/Library/UefiShellDebug1CommandsLib/SetVar.c

@@ -154,11 +154,15 @@ ShellCommandRunSetVar (
             // arbitrary buffer
             //
             Buffer = AllocateZeroPool((StrLen(Data) / 2));
-            for (LoopVar = 0 ; LoopVar < (StrLen(Data) / 2) ; LoopVar++) {
+            if (Buffer == NULL) {
-              ((UINT8*)Buffer)[LoopVar] = (UINT8)(HexCharToUintn(Data[LoopVar*2]) * 16);
+              Status = EFI_OUT_OF_RESOURCES;
-              ((UINT8*)Buffer)[LoopVar] = (UINT8)(((UINT8*)Buffer)[LoopVar] + HexCharToUintn(Data[LoopVar*2+1]));
+            } else {
+              for (LoopVar = 0 ; LoopVar < (StrLen(Data) / 2) ; LoopVar++) {
+                ((UINT8*)Buffer)[LoopVar] = (UINT8)(HexCharToUintn(Data[LoopVar*2]) * 16);
+                ((UINT8*)Buffer)[LoopVar] = (UINT8)(((UINT8*)Buffer)[LoopVar] + HexCharToUintn(Data[LoopVar*2+1]));
+              }
+              Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, StrLen(Data) / 2, Buffer);
             }
-            Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, StrLen(Data) / 2, Buffer);
             if (EFI_ERROR(Status)) {
               ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SETVAR_ERROR_SET), gShellDebug1HiiHandle, &Guid, VariableName, Status);
               ShellStatus = SHELL_ACCESS_DENIED;
@@ -181,11 +185,13 @@ ShellCommandRunSetVar (
           //
           Data++;
           Buffer = AllocateZeroPool(StrSize(Data) / 2);
-          AsciiSPrint(Buffer, StrSize(Data) / 2, "%s", Data);
+          if (Buffer == NULL) {
-          ((CHAR8*)Buffer)[AsciiStrLen(Buffer)-1] = CHAR_NULL;
+            Status = EFI_OUT_OF_RESOURCES;
-
+          } else {
-          
+            AsciiSPrint(Buffer, StrSize(Data) / 2, "%s", Data);
-          Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, AsciiStrSize(Buffer)-sizeof(CHAR8), Buffer);
+            ((CHAR8*)Buffer)[AsciiStrLen(Buffer)-1] = CHAR_NULL;
+            Status = gRT->SetVariable((CHAR16*)VariableName, &Guid, Attributes, AsciiStrSize(Buffer)-sizeof(CHAR8), Buffer);
+          }
           if (EFI_ERROR(Status)) {
             ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SETVAR_ERROR_SET), gShellDebug1HiiHandle, &Guid, VariableName, Status);
             ShellStatus = SHELL_ACCESS_DENIED;

ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/EventLogInfo.c

@@ -340,55 +340,56 @@ DisplaySysEventLogData (
   //
   Offset  = 0;
   Log     = (LOG_RECORD_FORMAT *) LogData;
-  while (Log->Type != END_OF_LOG && Offset < LogAreaLength) {
+  while (Log != NULL && Log->Type != END_OF_LOG && Offset < LogAreaLength) {
     //
     // Get a Event Log Record
     //
     Log = (LOG_RECORD_FORMAT *) (LogData + Offset);
 
-    //
+    if (Log != NULL) {
-    // Display Event Log Record Information
+      //
-    //
+      // Display Event Log Record Information
-    DisplaySELVarDataFormatType (Log->Type, SHOW_DETAIL);
+      //
-    DisplaySELLogHeaderLen (Log->Length, SHOW_DETAIL);
+      DisplaySELVarDataFormatType (Log->Type, SHOW_DETAIL);
+      DisplaySELLogHeaderLen (Log->Length, SHOW_DETAIL);
 
-    Offset += Log->Length;
+      Offset += Log->Length;
+      //
+      // Display Log Header Date/Time Fields
+      // These fields contain the BCD representation of the date and time
+      // (as read from CMOS) of the occurrence of the event
+      // So Print as hex and represent decimal
+      //
+      ShellPrintHiiEx(-1,-1,NULL,STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_DATE), gShellDebug1HiiHandle);
+      if (Log != NULL && Log->Year >= 80 && Log->Year <= 99) {
+        Print (L"19");
+      } else if (Log != NULL && Log->Year <= 79) {
+        Print (L"20");
+      } else {
+        ShellPrintHiiEx(-1,-1,NULL,STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_ERROR), gShellDebug1HiiHandle);
+        continue;
+      }
 
-    //
+      ShellPrintHiiEx(-1,-1,NULL,
-    // Display Log Header Date/Time Fields
+        STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_TIME_SIX_VARS),
-    // These fields contain the BCD representation of the date and time
+        gShellDebug1HiiHandle,
-    // (as read from CMOS) of the occurrence of the event
+        Log->Year,
-    // So Print as hex and represent decimal
+        Log->Month,
-    //
+        Log->Day,
-    ShellPrintHiiEx(-1,-1,NULL,STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_DATE), gShellDebug1HiiHandle);
+        Log->Hour,
-    if (Log != NULL && Log->Year >= 80 && Log->Year <= 99) {
+        Log->Minute,
-      Print (L"19");
+        Log->Second
-    } else if (Log != NULL && Log->Year <= 79) {
+       );
-      Print (L"20");
+
-    } else {
+      //
-      ShellPrintHiiEx(-1,-1,NULL,STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_ERROR), gShellDebug1HiiHandle);
+      // Display Variable Data Format
-      continue;
+      //
+      if (Log->Length <= (sizeof (LOG_RECORD_FORMAT) - 1)) {
+        continue;
+      }
+
+      ElVdfType = Log->LogVariableData[0];
+      DisplayElVdfInfo (ElVdfType, Log->LogVariableData);
     }
-
-    ShellPrintHiiEx(-1,-1,NULL,
-      STRING_TOKEN (STR_SMBIOSVIEW_EVENTLOGINFO_TIME_SIX_VARS),
-      gShellDebug1HiiHandle,
-      Log->Year,
-      Log->Month,
-      Log->Day,
-      Log->Hour,
-      Log->Minute,
-      Log->Second
-     );
-
-    //
-    // Display Variable Data Format
-    //
-    if (Log->Length <= (sizeof (LOG_RECORD_FORMAT) - 1)) {
-      continue;
-    }
-
-    ElVdfType = Log->LogVariableData[0];
-    DisplayElVdfInfo (ElVdfType, Log->LogVariableData);
   }
 }

ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.c

@@ -2,7 +2,7 @@
   Build a table, each item is (Key, Info) pair.
   And give a interface of query a string out of a table.
 
-  Copyright (c) 2005 - 2010, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2005 - 2011, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -2921,27 +2921,8 @@ TABLE_ITEM  StructureTypeInfoTable[] = {
 };
 
 
-UINT8
+/**
-QueryTable (
+  Given a table and a Key, return the responding info.
-  IN  TABLE_ITEM    *Table,
-  IN  UINTN         Number,
-  IN  UINT8         Key,
-  IN  OUT CHAR16    *Info
-  )
-/*++
-Routine Description:
-  Function Description
-    Given a table and a Key, return the responding info.
-
-  Arguments:
-    Table   -  The begin address of table
-    Number  -  The number of table items
-    Key     -  The query Key
-    Info    -  Input as empty buffer; output as data buffer.
-
-  Returns:
-    if Key found   - return found Key and Info
-    if Key unfound - return QUERY_TABLE_UNFOUND, Info=NULL
 
   Notes:
     Table[Index].Key is change from UINT8 to UINT16,
@@ -2955,7 +2936,23 @@ Routine Description:
     Then all the Key Value between Low and High gets the same string
     L"Unused".
 
+  @param[in] Table    The begin address of table.
+  @param[in] Number   The number of table items.
+  @param[in] Key      The query Key.
+  @param[in,out] Info Input as empty buffer; output as data buffer.
+  @param[in] InfoLen  The max number of characters for Info.
+
+  @return the found Key and Info is valid.
+  @retval QUERY_TABLE_UNFOUND and Info should be NULL.
 **/
+UINT8
+QueryTable (
+  IN  TABLE_ITEM    *Table,
+  IN  UINTN         Number,
+  IN  UINT8         Key,
+  IN  OUT CHAR16    *Info,
+  IN  UINTN         InfoLen
+  )
 {
   UINTN Index;
   //
@@ -2971,7 +2968,7 @@ Routine Description:
     // Check if Key is in the range
     //
     if (High > Low && Key >= Low && Key <= High) {
-      StrCpy (Info, Table[Index].Info);
+      StrnCpy (Info, Table[Index].Info, InfoLen-1);
       StrCat (Info, L"\n");
       return Key;
     }
@@ -2979,13 +2976,13 @@ Routine Description:
     // Check if Key == Value in the table
     //
     if (Table[Index].Key == Key) {
-      StrCpy (Info, Table[Index].Info);
+      StrnCpy (Info, Table[Index].Info, InfoLen-1);
       StrCat (Info, L"\n");
       return Key;
     }
   }
 
-  StrCpy (Info, L"Undefined Value\n");
+  StrnCpy (Info, L"Undefined Value\n", InfoLen);
   return QUERY_TABLE_UNFOUND;
 }
 
@@ -3069,7 +3066,7 @@ PrintBitsInfo (
     CHAR16  Info[66]; \
     Num = sizeof (Table) / sizeof (TABLE_ITEM); \
     ZeroMem (Info, sizeof (Info)); \
-    QueryTable (Table, Num, Key, Info); \
+    QueryTable (Table, Num, Key, Info, sizeof(Info)/sizeof(Info[0])); \
     Print (Info); \
   } while (0);
 

ShellPkg/Library/UefiShellDebug1CommandsLib/SmbiosView/QueryTable.h

@@ -2,7 +2,7 @@
   Build a table, each item is (key, info) pair.
   and give a interface of query a string out of a table.
 
-  Copyright (c) 2005 - 2010, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2005 - 2011, Intel Corporation. All rights reserved.<BR>
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
   which accompanies this distribution.  The full text of the license may be found at
@@ -37,12 +37,37 @@ typedef struct TABLE_ITEM {
     } \
   } while (0);
 
+/**
+  Given a table and a Key, return the responding info.
+
+  Notes:
+    Table[Index].Key is change from UINT8 to UINT16,
+    in order to deal with "0xaa - 0xbb".
+
+    For example:
+      DisplaySELVariableDataFormatTypes(UINT8 Type, UINT8 Option)
+    has a item:
+      "0x07-0x7F,   Unused"
+    Now define Key = 0x7F07, that is to say: High = 0x7F, Low = 0x07.
+    Then all the Key Value between Low and High gets the same string
+    L"Unused".
+
+  @param[in] Table    The begin address of table.
+  @param[in] Number   The number of table items.
+  @param[in] Key      The query Key.
+  @param[in,out] Info Input as empty buffer; output as data buffer.
+  @param[in] InfoLen  The max number of characters for Info.
+
+  @return the found Key and Info is valid.
+  @retval QUERY_TABLE_UNFOUND and Info should be NULL.
+**/
 UINT8
 QueryTable (
   IN  TABLE_ITEM    *Table,
   IN  UINTN         Number,
   IN  UINT8         Key,
-  IN  OUT CHAR16    *Info
+  IN  OUT CHAR16    *Info,
+  IN  UINTN         InfoLen
   );
 
 VOID

ShellPkg/Library/UefiShellDebug1CommandsLib/UefiShellDebug1CommandsLib.c

@@ -310,7 +310,9 @@ ConvertStringToGuid (
   TempCopy = StrnCatGrow(&TempCopy, NULL, StringGuid, 0);
   Walker   = TempCopy;
   TempSpot = StrStr(Walker, L"-");
-  *TempSpot = CHAR_NULL;
+  if (TempSpot != NULL) {
+    *TempSpot = CHAR_NULL;
+  }
   Status = ShellConvertStringToUint64(Walker, &TempVal, TRUE, FALSE);
   if (EFI_ERROR(Status)) {
     FreePool(TempCopy);
@@ -319,7 +321,9 @@ ConvertStringToGuid (
   Guid->Data1 = (UINT32)TempVal;
   Walker += 9;
   TempSpot = StrStr(Walker, L"-");
-  *TempSpot = CHAR_NULL;
+  if (TempSpot != NULL) {
+    *TempSpot = CHAR_NULL;
+  }
   Status = ShellConvertStringToUint64(Walker, &TempVal, TRUE, FALSE);
   if (EFI_ERROR(Status)) {
     FreePool(TempCopy);
@@ -328,7 +332,9 @@ ConvertStringToGuid (
   Guid->Data2 = (UINT16)TempVal;
   Walker += 5;
   TempSpot = StrStr(Walker, L"-");
-  *TempSpot = CHAR_NULL;
+  if (TempSpot != NULL) {
+    *TempSpot = CHAR_NULL;
+  }
   Status = ShellConvertStringToUint64(Walker, &TempVal, TRUE, FALSE);
   if (EFI_ERROR(Status)) {
     FreePool(TempCopy);

ShellPkg/Library/UefiShellInstall1CommandsLib/Bcfg.c

@@ -265,27 +265,31 @@ BcfgAddInstall1(
     FilePathSize = GetDevicePathSize (FilePath);
 
     TempByteBuffer = AllocateZeroPool(sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize);
-    TempByteStart  = TempByteBuffer;
+    if (TempByteBuffer != NULL) {
-    *((UINT32 *) TempByteBuffer) = LOAD_OPTION_ACTIVE;      // Attributes
+      TempByteStart  = TempByteBuffer;
-    TempByteBuffer += sizeof (UINT32);
+      *((UINT32 *) TempByteBuffer) = LOAD_OPTION_ACTIVE;      // Attributes
+      TempByteBuffer += sizeof (UINT32);
 
-    *((UINT16 *) TempByteBuffer) = (UINT16)FilePathSize;    // FilePathListLength
+      *((UINT16 *) TempByteBuffer) = (UINT16)FilePathSize;    // FilePathListLength
-    TempByteBuffer += sizeof (UINT16);
+      TempByteBuffer += sizeof (UINT16);
 
-    CopyMem (TempByteBuffer, Desc, DescSize);
+      CopyMem (TempByteBuffer, Desc, DescSize);
-    TempByteBuffer += DescSize;
+      TempByteBuffer += DescSize;
-    CopyMem (TempByteBuffer, FilePath, FilePathSize);
+      CopyMem (TempByteBuffer, FilePath, FilePathSize);
 
-    UnicodeSPrint (OptionStr, sizeof(OptionStr), L"%s%04x", Target == BcfgTargetBootOrder?L"Boot":L"Driver", TargetLocation);
+      UnicodeSPrint (OptionStr, sizeof(OptionStr), L"%s%04x", Target == BcfgTargetBootOrder?L"Boot":L"Driver", TargetLocation);
-    Status = gRT->SetVariable (
+      Status = gRT->SetVariable (
-          OptionStr,
+            OptionStr,
-          &gEfiGlobalVariableGuid,
+            &gEfiGlobalVariableGuid,
-          EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
+            EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
-          sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize,
+            sizeof(UINT32) + sizeof(UINT16) + DescSize + FilePathSize,
-          TempByteStart
+            TempByteStart
-         );
+           );
 
-    FreePool(TempByteStart);
+      FreePool(TempByteStart);
+    } else {
+      Status = EFI_OUT_OF_RESOURCES;
+    }
 
     if (EFI_ERROR(Status)) {
       ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_BCFG_SET_VAR_FAIL), gShellInstall1HiiHandle, OptionStr, Status);
@@ -385,22 +389,25 @@ BcfgRemoveInstall1(
     return (SHELL_INVALID_PARAMETER);
   }
   NewOrder = AllocateZeroPool(OrderCount*sizeof(CurrentOrder[0]));
-  NewCount = OrderCount;
+  if (NewOrder != NULL) {
-  CopyMem(NewOrder, CurrentOrder, OrderCount*sizeof(CurrentOrder[0]));
+    NewCount = OrderCount;
-  for (LoopVar = 0 ; LoopVar < OrderCount ; LoopVar++){
+    CopyMem(NewOrder, CurrentOrder, OrderCount*sizeof(CurrentOrder[0]));
-    if (NewOrder[LoopVar] == Location) {
+    for (LoopVar = 0 ; LoopVar < OrderCount ; LoopVar++){
-      CopyMem(NewOrder+LoopVar, NewOrder+LoopVar+1, (OrderCount - LoopVar - 1)*sizeof(CurrentOrder[0]));
+      if (NewOrder[LoopVar] == Location) {
-      NewCount--;
+        CopyMem(NewOrder+LoopVar, NewOrder+LoopVar+1, (OrderCount - LoopVar - 1)*sizeof(CurrentOrder[0]));
+        NewCount--;
+      }
     }
+    Status = gRT->SetVariable(
+      Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder",
+      (EFI_GUID*)&gEfiGlobalVariableGuid,
+      EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
+      NewCount*sizeof(NewOrder[0]),
+      NewOrder);
+    FreePool(NewOrder);
+  } else {
+    Status = EFI_OUT_OF_RESOURCES;
   }
-  Status = gRT->SetVariable(
-    Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder",
-    (EFI_GUID*)&gEfiGlobalVariableGuid,
-    EFI_VARIABLE_NON_VOLATILE|EFI_VARIABLE_BOOTSERVICE_ACCESS|EFI_VARIABLE_RUNTIME_ACCESS,
-    NewCount*sizeof(NewOrder[0]),
-    NewOrder);
-  FreePool(NewOrder);
-
   if (EFI_ERROR(Status)) {
     ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_BCFG_WRITE_FAIL), gShellInstall1HiiHandle, Target == BcfgTargetBootOrder?(CHAR16*)L"BootOrder":(CHAR16*)L"DriverOrder", Status);
     return (SHELL_INVALID_PARAMETER);

ShellPkg/Library/UefiShellLevel1CommandsLib/For.c

@@ -86,7 +86,17 @@ ShellCommandRunEndFor (
   Found = MoveToTag(GetPreviousNode, L"for", L"endfor", NULL, ShellCommandGetCurrentScriptFile(), FALSE, FALSE, FALSE);
 
   if (!Found) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"For", L"EndFor", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"For", 
+      L"EndFor", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_NOT_FOUND);
   }
   return (SHELL_SUCCESS);
@@ -305,7 +315,16 @@ ShellCommandRunFor (
     // Make sure that an End exists.
     //
     if (!MoveToTag(GetNextNode, L"endfor", L"for", NULL, CurrentScriptFile, TRUE, TRUE, FALSE)) {
-      ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"EndFor", L"For", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+      ShellPrintHiiEx(
+        -1, 
+        -1, 
+        NULL, 
+        STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+        gShellLevel1HiiHandle, 
+        L"EndFor", 
+        L"For", 
+        CurrentScriptFile->CurrentCommand!=NULL
+          ?CurrentScriptFile->CurrentCommand->Line:0);
       return (SHELL_DEVICE_ERROR);
     }
 

ShellPkg/Library/UefiShellLevel1CommandsLib/Goto.c

@@ -79,7 +79,17 @@ ShellCommandRunGoto (
       // Check forwards and then backwards for a label...
       //
       if (!MoveToTag(GetNextNode, L"endfor", L"for", CompareString, ShellCommandGetCurrentScriptFile(), FALSE, FALSE, TRUE)) {
-        ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, CompareString, L"Goto", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+        ShellPrintHiiEx(
+          -1, 
+          -1, 
+          NULL, 
+          STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+          gShellLevel1HiiHandle, 
+          CompareString, 
+          L"Goto", 
+          ShellCommandGetCurrentScriptFile()!=NULL
+            &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+              ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
         ShellStatus = SHELL_NOT_FOUND;
       }
     FreePool(CompareString);

ShellPkg/Library/UefiShellLevel1CommandsLib/If.c

@@ -844,7 +844,17 @@ ShellCommandRunIf (
   // Make sure that an End exists.
   //
   if (!MoveToTag(GetNextNode, L"endif", L"if", NULL, ShellCommandGetCurrentScriptFile(), TRUE, TRUE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"EnfIf", L"If", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"EnfIf", 
+      L"If", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
 
@@ -983,16 +993,46 @@ ShellCommandRunElse (
 
 
   if (!MoveToTag(GetPreviousNode, L"if", L"endif", NULL, ShellCommandGetCurrentScriptFile(), FALSE, TRUE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"If", L"Else", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"If", 
+      L"Else", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
   if (!MoveToTag(GetPreviousNode, L"if", L"else", NULL, ShellCommandGetCurrentScriptFile(), FALSE, TRUE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"If", L"Else", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"If", 
+      L"Else", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
 
   if (!MoveToTag(GetNextNode, L"endif", L"if", NULL, ShellCommandGetCurrentScriptFile(), FALSE, FALSE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"EndIf", "Else", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"EndIf", 
+      "Else", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
 
@@ -1025,7 +1065,17 @@ ShellCommandRunEndIf (
   }
 
   if (!MoveToTag(GetPreviousNode, L"if", L"endif", NULL, ShellCommandGetCurrentScriptFile(), FALSE, TRUE, FALSE)) {
-    ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_SYNTAX_NO_MATCHING), gShellLevel1HiiHandle, L"If", L"EndIf", ShellCommandGetCurrentScriptFile()->CurrentCommand->Line);
+    ShellPrintHiiEx(
+      -1, 
+      -1, 
+      NULL, 
+      STRING_TOKEN (STR_SYNTAX_NO_MATCHING), 
+      gShellLevel1HiiHandle, 
+      L"If", 
+      L"EndIf", 
+      ShellCommandGetCurrentScriptFile()!=NULL
+        &&ShellCommandGetCurrentScriptFile()->CurrentCommand!=NULL
+          ?ShellCommandGetCurrentScriptFile()->CurrentCommand->Line:0);
     return (SHELL_DEVICE_ERROR);
   }
 

ShellPkg/Library/UefiShellLevel2CommandsLib/Map.c

@@ -330,6 +330,9 @@ MappingListHasType(
   //
   if (Specific != NULL) {
     NewSpecific = AllocateZeroPool(StrSize(Specific) + sizeof(CHAR16));
+    if (NewSpecific == NULL){
+      return FALSE;
+    }
     StrCpy(NewSpecific, Specific);
     if (NewSpecific[StrLen(NewSpecific)-1] != L':') {
       StrCat(NewSpecific, L":");
@@ -609,7 +612,7 @@ PerformMappingDisplay(
   // Get the map name(s) for each one.
   //
   for ( LoopVar = 0, Found = FALSE
-      ; LoopVar < (BufferSize / sizeof(EFI_HANDLE))
+      ; LoopVar < (BufferSize / sizeof(EFI_HANDLE)) && HandleBuffer != NULL
       ; LoopVar ++
      ){
     Status = PerformSingleMappingDisplay(
@@ -635,7 +638,7 @@ PerformMappingDisplay(
     &BufferSize,
     HandleBuffer);
   if (Status == EFI_BUFFER_TOO_SMALL) {
-    FreePool(HandleBuffer);
+    SHELL_FREE_NON_NULL(HandleBuffer);
     HandleBuffer = AllocateZeroPool(BufferSize);
     if (HandleBuffer == NULL) {
       return (SHELL_OUT_OF_RESOURCES);
@@ -897,6 +900,9 @@ AddMappingFromMapping(
   CHAR16                          *NewSName;
   
   NewSName = AllocateZeroPool(StrSize(SName) + sizeof(CHAR16));
+  if (NewSName == NULL) {
+    return (SHELL_OUT_OF_RESOURCES);
+  }
   StrCpy(NewSName, SName);
   if (NewSName[StrLen(NewSName)-1] != L':') {
     StrCat(NewSName, L":");
@@ -947,6 +953,9 @@ AddMappingFromHandle(
   CHAR16                    *NewSName;
   
   NewSName = AllocateZeroPool(StrSize(SName) + sizeof(CHAR16));
+  if (NewSName == NULL) {
+    return (SHELL_OUT_OF_RESOURCES);
+  }
   StrCpy(NewSName, SName);
   if (NewSName[StrLen(NewSName)-1] != L':') {
     StrCat(NewSName, L":");

ShellPkg/Library/UefiShellLevel2CommandsLib/TimeDate.c

@@ -124,7 +124,7 @@ CheckAndSetDate (
   if (Walker1 != NULL) {
     Walker = Walker1 + 1;
   }
-  Walker1 = StrStr(Walker, L"/");
+  Walker1 = Walker!=NULL?StrStr(Walker, L"/"):NULL;
   if (Walker1 != NULL && *Walker1 == L'/') {
     *Walker1 = CHAR_NULL;
   }
@@ -133,7 +133,7 @@ CheckAndSetDate (
     if (Walker1 != NULL) {
       Walker = Walker1 + 1;
     }
-    Walker1 = StrStr(Walker, L"/");
+    Walker1 = Walker!=NULL?StrStr(Walker, L"/"):NULL;
     if (Walker1 != NULL && *Walker1 == L'/') {
       *Walker1 = CHAR_NULL;
     }
@@ -312,7 +312,7 @@ CheckAndSetTime (
     TheTime.Hour    = 0xFF;
     TheTime.Minute  = 0xFF;
 
-    Walker2          = StrStr(Walker1, L":");
+    Walker2          = Walker1!=NULL?StrStr(Walker1, L":"):NULL;
     if (Walker2 != NULL && *Walker2 == L':') {
       *Walker2 = CHAR_NULL;
     }
@@ -320,7 +320,7 @@ CheckAndSetTime (
     if (Walker2 != NULL) {
       Walker1 = Walker2 + 1;
     }
-    Walker2          = StrStr(Walker1, L":");
+    Walker2          = Walker1!=NULL?StrStr(Walker1, L":"):NULL;
     if (Walker2 != NULL && *Walker2 == L':') {
       *Walker2 = CHAR_NULL;
     }

ShellPkg/Library/UefiShellLevel2CommandsLib/Vol.c

@@ -97,6 +97,8 @@ HandleVol(
       SysInfo);
   }
 
+  ASSERT(SysInfo != NULL);
+
   if (Delete) {
     StrCpy ((CHAR16 *) SysInfo->VolumeLabel, L"");
     SysInfo->Size = SIZE_OF_EFI_FILE_SYSTEM_INFO + StrSize(SysInfo->VolumeLabel);

ShellPkg/Library/UefiShellNetwork1CommandsLib/Ifconfig.c

@@ -606,13 +606,19 @@ IfconfigGetAllNicInfoByHii (
     // Construct configuration request string header
     //
     ConfigHdr = ConstructConfigHdr (&gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE, ChildHandle);
-    Length = StrLen (ConfigHdr);
+    if (ConfigHdr != NULL) {
+      Length = StrLen (ConfigHdr);
+    } else {
+      Length = 0;
+    }
     ConfigResp = AllocateZeroPool ((Length + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
     if (ConfigResp == NULL) {
       Status = EFI_OUT_OF_RESOURCES;
       goto ON_ERROR;
     }
-    StrCpy (ConfigResp, ConfigHdr);
+    if (ConfigHdr != NULL) {
+      StrCpy (ConfigResp, ConfigHdr);
+    }
  
     //
     // Append OFFSET/WIDTH pair
@@ -772,10 +778,15 @@ IfconfigSetNicAddrByHii (
   // Construct config request string header
   //
   ConfigHdr = ConstructConfigHdr (&gEfiNicIp4ConfigVariableGuid, EFI_NIC_IP4_CONFIG_VARIABLE, ChildHandle);
-
+  if (ConfigHdr != NULL) {
-  Length = StrLen (ConfigHdr);
+    Length = StrLen (ConfigHdr);
+  } else {
+    Length = 0;
+  }
   ConfigResp = AllocateZeroPool ((Length + NIC_ITEM_CONFIG_SIZE * 2 + 100) * sizeof (CHAR16));
-  StrCpy (ConfigResp, ConfigHdr);
+  if (ConfigHdr != NULL) {
+    StrCpy (ConfigResp, ConfigHdr);
+  }
 
   NicConfig = AllocateZeroPool (NIC_ITEM_CONFIG_SIZE);
   if (NicConfig == NULL) {

ShellPkg/Library/UefiShellNetwork1CommandsLib/Ping.c

@@ -883,7 +883,7 @@ PingCreateIpInstance (
                   &HandleNum,
                   &HandleBuffer
                   );
-  if (EFI_ERROR (Status) || (HandleNum == 0)) {
+  if (EFI_ERROR (Status) || (HandleNum == 0) || (HandleBuffer == NULL)) {
     return EFI_ABORTED;
   }
   //