Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 8c66d989635db3b512036c9388d57a8edec42e2c
https://github.com/tianocore/edk2/commit/8c66d989635db3b512036c9388d57a8edec42e2c
Author: Aaron Pop <[email protected]>
Date: 2026-08-05 (Wed, 05 Aug 2026)
Changed paths:
M MdeModulePkg/Library/UefiHiiLib/HiiLib.c
Log Message:
-----------
MdeModulePkg: Fix comparison with wider widths
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <[email protected]>
Commit: 1d63461c915990f10366a581771a34a426a3574f
https://github.com/tianocore/edk2/commit/1d63461c915990f10366a581771a34a426a3574f
Author: Aaron Pop <[email protected]>
Date: 2026-08-05 (Wed, 05 Aug 2026)
Changed paths:
M MdeModulePkg/Library/UefiHiiLib/HiiLib.c
Log Message:
-----------
MdeModulePkg: Fix missing NULL tests
https://github.com/github/codeql/blob/codeql-cli-2.7.3/cpp/ql/src/Critical/MissingNullTest.qhelp
For items which allocate memory, or get a pointer from another
structure, it is important to validate that the pointers
are not null before they are dereferenced.
Signed-off-by: Aaron Pop <[email protected]>
Commit: 476b78bbad7e2c126002a7dde332dbf67ae7b172
https://github.com/tianocore/edk2/commit/476b78bbad7e2c126002a7dde332dbf67ae7b172
Author: Aaron Pop <[email protected]>
Date: 2026-08-05 (Wed, 05 Aug 2026)
Changed paths:
M MdeModulePkg/Library/UefiHiiLib/HiiLib.c
M MdeModulePkg/Library/UefiHiiLib/UefiHiiLib.inf
Log Message:
-----------
MdeModulePkg: Fix Comparison overflow
https://github.com/github/codeql/blob/codeql-cli-2.7.3/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.qhelp
Switch to using SafeUint16Add for calculating offsets into
block data. The data being used in the calculation comes from
config block strings, and there is no validation of the values
before the calculation occurs.
Signed-off-by: Aaron Pop <[email protected]>
Compare: https://github.com/tianocore/edk2/compare/9b3ceeb254db...476b78bbad7e
To unsubscribe from these emails, change your notification settings at
https://github.com/tianocore/edk2/settings/notifications
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
