In the function HiiConfigRoutingExportConfig() in MdeModulePkg/Universal/HiiDatabaseDxe/ConfigRouting.c, the string pointer AccessResults is not initialized like the other pointers are. This variable should be set to NULL near line 5295, along with the other pointers.

In testing my company’s BIOS with uefi-sct, I found strange behavior that I traced to this variable not being initialized before calling ConfigAccess->ExtractConfig() at line 5322. If you check lines 4875 through 4888, you will find this other function does initialize its pointer variables.

Also, AccessResults is not checked for NULL before it is used at line 5357. This could result in StrStr() and GetElementsFromRequest() both being passed a NULL pointer and this section of code would be invalid.

This attached patch solves both problems, it initializes the pointer to NULL, and it checks for NULL after calling ConfigAccess->ExtractConfig(). As a result of implementing my patch, my company's BIOS passed the uefi-sct without issue. I also checked a much older BIOS that we have, and the problem exists there as well. It appears this uninitialized pointer has been around for no less than 10 years.