diff options
author | gechao <gechao@greatwall.com.cn> | 2021-01-14 11:22:59 +0800 |
---|---|---|
committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2021-02-03 01:56:42 +0000 |
commit | 839f649abb6d11fa3e9137ba2afdb2d1d037ba60 (patch) | |
tree | 462817a9a2efb6f0f8fa0261276612f8b2617ac7 /MdeModulePkg/Universal/Console | |
parent | 3f90ac3ec03512e2374cd2968c047a7e856a8965 (diff) | |
download | edk2-839f649abb6d11fa3e9137ba2afdb2d1d037ba60.zip edk2-839f649abb6d11fa3e9137ba2afdb2d1d037ba60.tar.gz edk2-839f649abb6d11fa3e9137ba2afdb2d1d037ba60.tar.bz2 |
MdeModulePkg/TerminalDxe: Terminal fifo buffer overflow.
Fix the bug of terminal fifo buffer overflow with UINT8 type.
typedef struct {
UINT8 Head;
UINT8 Tail;
UINT8 Data[RAW_FIFO_MAX_NUMBER + 1];
} RAW_DATA_FIFO;
RAW_FIFO_MAX_NUMBER is 256.
the data buffer size is 257 (Index from 0 to 256), but the max value of
the index, Head or Tail (UINT8), is 255. That means the last data of the
data buffer would be always empty if we use Head/Tail to output/input the
data correctly. And because of the incorrect buffer size the FIFO full
check "((Tail + 1) % (RAW_FIFO_MAX_NUMBER + 1)) == Head" would never meet.
Signed-off-by: gechao <gechao@greatwall.com.cn>
Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
Diffstat (limited to 'MdeModulePkg/Universal/Console')
-rw-r--r-- | MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h index 378ace1..360e58e 100644 --- a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h +++ b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.h @@ -37,7 +37,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include <Library/BaseLib.h>
-#define RAW_FIFO_MAX_NUMBER 256
+#define RAW_FIFO_MAX_NUMBER 255
#define FIFO_MAX_NUMBER 128
typedef struct {
|