IndexTable->Length is used as index in array IndexTable->Index[].
So IndexTable->Length needs to be checked, which should be less than
the array size.
Cc: Hao A Wu <hao.a...@intel.com>
Cc: Liming Gao <liming....@intel.com>
Signed-off-by: Shenglei Zhang <shenglei.zh...@intel.com>
---
MdeModulePkg/Universal/Variable/Pei/Variable.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/MdeModulePkg/Universal/Variable/Pei/Variable.c
b/MdeModulePkg/Universal/Variable/Pei/Variable.c
index 715802f33c29..f61465fc3045 100644
--- a/MdeModulePkg/Universal/Variable/Pei/Variable.c
+++ b/MdeModulePkg/Universal/Variable/Pei/Variable.c
@@ -896,7 +896,7 @@ FindVariableEx (
//
if ((IndexTable != NULL) && !StopRecord) {
Offset = (UINTN) Variable - (UINTN) LastVariable;
- if ((Offset > 0x0FFFF) || (IndexTable->Length == sizeof
(IndexTable->Index) / sizeof (IndexTable->Index[0]))) {
+ if ((Offset > 0x0FFFF) || (IndexTable->Length >= sizeof
(IndexTable->Index) / sizeof (IndexTable->Index[0]))) {
//
// Stop to record if the distance of two neighbouring VAR_ADDED
variable is larger than the allowable scope(UINT16),
// or the record buffer is full.
--
2.18.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#49143): https://edk2.groups.io/g/devel/message/49143
Mute This Topic: https://groups.io/mt/34668808/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
