sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MdeModulePkg/Ps2Mouse: Fix potential buffer overflow issue.

Browse Source 
Count is initially 1 but is assigned to 2 in case PS2_READ_DATA_BYTE.
Though the state machine doesn't go back from PS2_READ_DATA_BYTE to
PS2_READ_BYTE_ONE (not a true bug), force assign Count to 1 to avoid
potential buffer overflow issue.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Shumin Qiu <shumin.qiu@intel.com>
This commit is contained in:
Ruiyu Ni
2016-04-13 14:11:38 +08:00
parent 8d878f84d2
commit aab04141dc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
MdeModulePkg/Bus/Isa/Ps2MouseDxe/CommPs2.c
View File

@@ -343,7 +343,6 @@ PS2MouseGetPacket (
BOOLEAN RButton; BOOLEAN RButton;
KeyboardEnable = FALSE; KeyboardEnable = FALSE;
Count = 1;
State = PS2_READ_BYTE_ONE; State = PS2_READ_BYTE_ONE;
// //
@@ -357,6 +356,7 @@ PS2MouseGetPacket (
// Read mouse first byte data, if failed, immediately return // Read mouse first byte data, if failed, immediately return
// //
KbcDisableAux (); KbcDisableAux ();
Count = 1;
Status = PS2MouseRead (&Data, &Count, State); Status = PS2MouseRead (&Data, &Count, State);
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
KbcEnableAux (); KbcEnableAux ();