mirror of https://github.com/acidanthera/audk.git
9c0e4db3db
The commit adds check in function InternalPrintGraphic() to ensure that the expression: Blt->Width * Blt->Height * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) will not overflow in the UINTN range. The commit also adds an explicit UINT32 type cast for 'Blt->Width' to avoid possible overflow in the int range for: Blt->Width * Blt->Height Since both Blt->Width and Blt->Height are of type UINT16. They will be promoted to int (signed) first, and then perform the multiplication operation. If the result of multiplication between Blt->Width and Blt->Height exceeds the range of type int, a potential incorrect size will be passed into function AllocateZeroPool(). Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> |
||
|---|---|---|
| .. | ||
| DxeIoLibCpuIo | ||
| DxeSmmDriverEntryPoint | ||
| FrameworkUefiLib | ||
| PeiHobLibFramework | ||
| PeiSmbusLibSmbusPpi | ||