From 51fe5b5140ba9ecb168fb03da328983355880c7a Mon Sep 17 00:00:00 2001
From: Ruiyu Ni <ruiyu.ni@intel.com>
Date: Mon, 25 Jun 2018 15:35:06 +0800
Subject: [PATCH] MdeModulePkg/BmpSupportLib: Check PixelHeight/PixelWidth
 against 0

The patch adds check logic to make sure that for a input BMP file,
the width or height is not 0; for a input GOP blt buffer, the width
or height is not 0. Otherwise, UNSUPPORTED status is returned.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
---
 MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c b/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c
index 2c23e2c61c..6196262d14 100644
--- a/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c
+++ b/MdeModulePkg/Library/BaseBmpSupportLib/BmpSupportLib.c
@@ -148,6 +148,11 @@ TranslateBmpToGopBlt (
     return RETURN_UNSUPPORTED;
   }
 
+  if ((BmpHeader->PixelHeight == 0) || (BmpHeader->PixelWidth == 0)) {
+    DEBUG ((DEBUG_ERROR, "TranslateBmpToGopBlt: BmpHeader->PixelHeight or BmpHeader->PixelWidth is 0.\n"));
+    return RETURN_UNSUPPORTED;
+  }
+
   //
   // Only support BITMAPINFOHEADER format.
   // BITMAPFILEHEADER + BITMAPINFOHEADER = BMP_IMAGE_HEADER
@@ -484,6 +489,10 @@ TranslateGopBltToBmp (
     return RETURN_INVALID_PARAMETER;
   }
 
+  if ((PixelHeight == 0) || (PixelWidth == 0)) {
+    return RETURN_UNSUPPORTED;
+  }
+
   //
   // Allocate memory for BMP file.
   //