Re: [edk2-platforms] [PATCH V1 1/2] MinPlatformPkg: Add missing bounds checks to CompressLib

["Chiu, Chasel" <chasel.chiu@intel.com>]

Reviewed-by: Chasel Chiu <chasel.chiu@intel.com>


> -----Original Message-----
> From: Nate DeSimone <nathaniel.l.desimone@intel.com>
> Sent: Wednesday, September 30, 2020 8:15 AM
> To: devel@edk2.groups.io
> Cc: Chiu, Chasel <chasel.chiu@intel.com>; Liming Gao
> <gaoliming@byosoft.com.cn>; Dong, Eric <eric.dong@intel.com>
> Subject: [edk2-platforms] [PATCH V1 1/2] MinPlatformPkg: Add missing bounds
> checks to CompressLib
> 
> Current code only as bounds checks in ASSERT macros.
> They are also needed in release mode where ASSERT is not used.
> 
> Signed-off-by: Nate DeSimone <nathaniel.l.desimone@intel.com>
> Cc: Chasel Chiu <chasel.chiu@intel.com>
> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> Cc: Eric Dong <eric.dong@intel.com>
> ---
>  .../MinPlatformPkg/Library/CompressLib/CompressLib.c   | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/Platform/Intel/MinPlatformPkg/Library/CompressLib/CompressLib.c
> b/Platform/Intel/MinPlatformPkg/Library/CompressLib/CompressLib.c
> index 9f93e1ee2d..537eb3b693 100644
> --- a/Platform/Intel/MinPlatformPkg/Library/CompressLib/CompressLib.c
> +++ b/Platform/Intel/MinPlatformPkg/Library/CompressLib/CompressLib.c
> @@ -1002,7 +1002,10 @@ CountTFreq (
>          mTFreq[2]++;
>        }
>      } else {
> -      ASSERT((LoopVar3+2)<(2 * NT - 1));
> +      ASSERT ((LoopVar3 + 2) < (2 * NT - 1));
> +      if ((LoopVar3 + 2) >= (2 * NT - 1)) {
> +        return;
> +      }
>        mTFreq[LoopVar3 + 2]++;
>      }
>    }
> @@ -1101,7 +1104,10 @@ WriteCLen (
>          PutBits (CBIT, Count - 20);
>        }
>      } else {
> -      ASSERT((LoopVar3+2)<NPT);
> +      ASSERT ((LoopVar3 + 2) < NPT);
> +      if ((LoopVar3 + 2) >= NPT) {
> +        return;
> +      }
>        PutBits (mPTLen[LoopVar3 + 2], mPTCode[LoopVar3 + 2]);
>      }
>    }
> --
> 2.27.0.windows.1