Re: [PATCH v2 0/2] MdeModulePkg: Resolve buffer cross boundary access in Ramdisk

[Laszlo Ersek <lersek@redhat.com>]

On 02/28/19 02:32, Gao, Liming wrote:
> I update https://github.com/tianocore/tianocore.github.io/wiki/Commit-Message-Format with CVE example. Please check it. 

"CVE fix needs to append CVE number in Brief-single-line-summary. The
format is 'Pkg-Module: Brief-single-line-summary (CVE-Year-Number)'. Its
length should be less than 92 characters."

Let's use the following suffix as example:

" (CVE-2018-12180)"

(the Number part is supposed to fit into 5 digits)

The length of this suffix is 17 characters. For normal cases, we have an
inclusive limit of 74 characters. So for CVE subjects the inclusive
limit is 74+17=91 characters. The wiki page states an exclusive limit of
92 chars, which is the same.

So, I think the update is perfect.

Thanks
Laszlo