mirror of https://github.com/acidanthera/audk.git
9c0e4db3db
The commit adds check in function InternalPrintGraphic() to ensure that the expression: Blt->Width * Blt->Height * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) will not overflow in the UINTN range. The commit also adds an explicit UINT32 type cast for 'Blt->Width' to avoid possible overflow in the int range for: Blt->Width * Blt->Height Since both Blt->Width and Blt->Height are of type UINT16. They will be promoted to int (signed) first, and then perform the multiplication operation. If the result of multiplication between Blt->Width and Blt->Height exceeds the range of type int, a potential incorrect size will be passed into function AllocateZeroPool(). Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> |
||
|---|---|---|
| .. | ||
| Console.c | ||
| FrameworkUefiLib.inf | ||
| FrameworkUefiLib.uni | ||
| UefiDriverModel.c | ||
| UefiLib.c | ||
| UefiLibInternal.h | ||
| UefiLibPrint.c | ||
| UefiNotTiano.c | ||