From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by mx.groups.io with SMTP id smtpd.web10.1892.1571282378907852418 for ; Wed, 16 Oct 2019 20:19:39 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.24, mailfrom: shenglei.zhang@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 Oct 2019 20:19:38 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.67,306,1566889200"; d="scan'208";a="208127699" Received: from shenglei-dev.ccr.corp.intel.com ([10.239.158.52]) by orsmga002.jf.intel.com with ESMTP; 16 Oct 2019 20:19:37 -0700 From: "Zhang, Shenglei" To: devel@edk2.groups.io Cc: Hao A Wu , Liming Gao Subject: [PATCH] MdeModulePkg/Variable/Pei: Update the condition in if statement Date: Thu, 17 Oct 2019 11:19:35 +0800 Message-Id: <20191017031935.19796-1-shenglei.zhang@intel.com> X-Mailer: git-send-email 2.18.0.windows.1 IndexTable->Length is used as index in array IndexTable->Index[]. So IndexTable->Length needs to be checked, which should be less than the array size. Cc: Hao A Wu Cc: Liming Gao Signed-off-by: Shenglei Zhang --- MdeModulePkg/Universal/Variable/Pei/Variable.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MdeModulePkg/Universal/Variable/Pei/Variable.c b/MdeModulePkg/Universal/Variable/Pei/Variable.c index 715802f33c29..f61465fc3045 100644 --- a/MdeModulePkg/Universal/Variable/Pei/Variable.c +++ b/MdeModulePkg/Universal/Variable/Pei/Variable.c @@ -896,7 +896,7 @@ FindVariableEx ( // if ((IndexTable != NULL) && !StopRecord) { Offset = (UINTN) Variable - (UINTN) LastVariable; - if ((Offset > 0x0FFFF) || (IndexTable->Length == sizeof (IndexTable->Index) / sizeof (IndexTable->Index[0]))) { + if ((Offset > 0x0FFFF) || (IndexTable->Length >= sizeof (IndexTable->Index) / sizeof (IndexTable->Index[0]))) { // // Stop to record if the distance of two neighbouring VAR_ADDED variable is larger than the allowable scope(UINT16), // or the record buffer is full. -- 2.18.0.windows.1