ShellPkg: BcfgDisplayDump(): enforce minimum size for Boot#### and co.

"3.1.1 Boot Manager Programming" in the UEFI 2.5 spec mandates that
Boot#### and similar options contain EFI_LOAD_OPTION structures. The
EFI_LOAD_OPTION structure encodes the fixed initial part of the payload,
and we can (and should) use it to enforce a minimum size for variable
contents.

This patch is meant as a safety improvement.

Cc: Jaben Carsey <jaben.carsey@intel.com>
Cc: Ryan Harkin <ryan.harkin@linaro.org>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19710 6f19259b-4bc3-4df7-8a09-765794883524

ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c

@@ -1052,6 +1052,7 @@ BcfgDisplayDump(
   CHAR16          *DevPathString;
   VOID            *DevPath;
   UINTN           Errors;
+  EFI_LOAD_OPTION *LoadOption;
 
   if (OrderCount == 0) {
     ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_BCFG_NONE), gShellBcfgHiiHandle, L"bcfg");  
@@ -1090,6 +1091,24 @@ BcfgDisplayDump(
       goto Cleanup;
     }
 
+    //
+    // We expect the Attributes, FilePathListLength, and L'\0'-terminated
+    // Description fields to be present.
+    //
+    if (BufferSize < sizeof *LoadOption + sizeof (CHAR16)) {
+      ShellPrintHiiEx (
+        -1,
+        -1,
+        NULL,
+        STRING_TOKEN (STR_BCFG_VAR_CORRUPT),
+        gShellBcfgHiiHandle,
+        L"bcfg",
+        VariableName
+        );
+      ++Errors;
+      goto Cleanup;
+    }
+
     if ((*(UINT16*)(Buffer+4)) != 0) {
       DevPath = AllocateZeroPool(*(UINT16*)(Buffer+4));
       if (DevPath != NULL) {