mirror of https://github.com/acidanthera/audk.git
458cd568b6
The commit adds check in function InternalPrintGraphic() to ensure that the expression: Blt->Width * Blt->Height * sizeof (EFI_GRAPHICS_OUTPUT_BLT_PIXEL) will not overflow in the UINTN range. The commit also adds an explicit UINT32 type cast for 'Blt->Width' to avoid possible overflow in the int range for: Blt->Width * Blt->Height Since both Blt->Width and Blt->Height are of type UINT16. They will be promoted to int (signed) first, and then perform the multiplication operation. If the result of multiplication between Blt->Width and Blt->Height exceeds the range of type int, a potential incorrect size will be passed into function AllocateZeroPool(). Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> |
||
---|---|---|
.. | ||
Console.c | ||
UefiDriverModel.c | ||
UefiLib.c | ||
UefiLib.inf | ||
UefiLib.uni | ||
UefiLibInternal.h | ||
UefiLibPrint.c | ||
UefiNotTiano.c |