From e880c307c5808a9a972e5bf3b859396610edd67b Mon Sep 17 00:00:00 2001 From: Michael Kubacki Date: Thu, 7 Sep 2023 21:23:28 -0400 Subject: [PATCH] MdeModulePkg/BootMaintenanceManagerUiLib: Check array index before access Many arrays are defined with a length of MAX_MENU_NUMBER in FormGuid.h. Two of those are BootOptionOrder and DriverOptionOrder. In UpdatePage.c, a pointer is set to either of those arrays. The array buffer is accessed using an index whose range is checked after the pointer to the array is dereferenced. This change moves the check before the dereference. In another place in the file, the ConsoleCheck pointer is also set to an array buffer with MAX_MENU_NUMBER elements. Only an ASSERT() currently checks the range of the array index. This change conditionalizes the pointer dereference itself on the range of Index. Cc: Jian J Wang Cc: Liming Gao Cc: Dandan Bi Cc: Eric Dong Signed-off-by: Michael Kubacki Reviewed-by: Dandan Bi --- .../Library/BootMaintenanceManagerUiLib/UpdatePage.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.c b/MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.c index ca81b7f352..b1d1e2ee44 100644 --- a/MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.c +++ b/MdeModulePkg/Library/BootMaintenanceManagerUiLib/UpdatePage.c @@ -527,9 +527,12 @@ UpdateConsolePage ( ((NewTerminalContext->IsStdErr != 0) && (UpdatePageId == FORM_CON_ERR_ID)) ) { - CheckFlags |= EFI_IFR_CHECKBOX_DEFAULT; - ConsoleCheck[Index] = TRUE; - } else { + CheckFlags |= EFI_IFR_CHECKBOX_DEFAULT; + + if (Index < MAX_MENU_NUMBER) { + ConsoleCheck[Index] = TRUE; + } + } else if (Index < MAX_MENU_NUMBER) { ConsoleCheck[Index] = FALSE; } @@ -622,7 +625,7 @@ UpdateOrderPage ( ASSERT (OptionsOpCodeHandle != NULL); NewMenuEntry = NULL; - for (OptionIndex = 0; (OptionOrder[OptionIndex] != 0 && OptionIndex < MAX_MENU_NUMBER); OptionIndex++) { + for (OptionIndex = 0; (OptionIndex < MAX_MENU_NUMBER && OptionOrder[OptionIndex] != 0); OptionIndex++) { BootOptionFound = FALSE; for (Index = 0; Index < OptionMenu->MenuNumber; Index++) { NewMenuEntry = BOpt_GetMenuEntry (OptionMenu, Index);