IntelSiliconPkg/SmmAccess: Fix potential integer overflow in loop com…

…parison SmmAccessDxe: `mSmmAccess.NumberRegions` is a `UINTN` while the loop index variable compared against it is a `UINT8`. This can lead to an overflow of the loop index for `mSmmAccess.NumberRegions` for values larger than `UINT8_MAX`. This change makes `Index` a `UINTN` to match in width. PeiSmmAccessLib: Fixes a similar `UINT8` loop index issue. Signed-off-by: Michael Kubacki <[email protected]>
tianocore · Oct 3, 2024 · eac8ed1 · eac8ed1
1 parent a6a26fe
commit eac8ed1
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/Silicon/Intel/IntelSiliconPkg/Feature/SmmAccess/Library/PeiSmmAccessLib/PeiSmmAccessLib.c b/Silicon/Intel/IntelSiliconPkg/Feature/SmmAccess/Library/PeiSmmAccessLib/PeiSmmAccessLib.c
@@ -108,7 +108,7 @@ Close (
 {
   SMM_ACCESS_PRIVATE_DATA *SmmAccess;
   BOOLEAN                 OpenState;
-  UINT8                   Index;
+  UINTN                   Index;
 
   SmmAccess = SMM_ACCESS_PRIVATE_DATA_FROM_THIS (This);
   if (DescriptorIndex >= SmmAccess->NumberRegions) {

diff --git a/Silicon/Intel/IntelSiliconPkg/Feature/SmmAccess/SmmAccessDxe/SmmAccessDriver.c b/Silicon/Intel/IntelSiliconPkg/Feature/SmmAccess/SmmAccessDxe/SmmAccessDriver.c
@@ -166,7 +166,7 @@ Close (
 {
   SMM_ACCESS_PRIVATE_DATA *SmmAccess;
   BOOLEAN                 OpenState;
-  UINT8                   Index;
+  UINTN                   Index;
   UINTN                   DescriptorIndex;
 
   SmmAccess = SMM_ACCESS_PRIVATE_DATA_FROM_THIS (This);