mirror of https://github.com/acidanthera/audk.git
9c0e4db3db
The commit adds check in function InternalPrintGraphic() to ensure that the expression: Blt->Width * Blt->Height * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) will not overflow in the UINTN range. The commit also adds an explicit UINT32 type cast for 'Blt->Width' to avoid possible overflow in the int range for: Blt->Width * Blt->Height Since both Blt->Width and Blt->Height are of type UINT16. They will be promoted to int (signed) first, and then perform the multiplication operation. If the result of multiplication between Blt->Width and Blt->Height exceeds the range of type int, a potential incorrect size will be passed into function AllocateZeroPool(). Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> |
||
|---|---|---|
| .. | ||
| Include | ||
| Library | ||
| Contributions.txt | ||
| FrameworkSpecConformance.txt | ||
| IntelFrameworkPkg.dec | ||
| IntelFrameworkPkg.dsc | ||
| IntelFrameworkPkg.uni | ||
| IntelFrameworkPkgExtra.uni | ||
| License.txt | ||