3 files changed, 15 insertions, 3 deletions
diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c
index 4b275951e8..4a056e89d8 100644
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c
+++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRand.c
@@ -43,6 +43,10 @@ RandomSeed (
   IN  UINTN         SeedSize
   )
 {
+  if (SeedSize > INT_MAX) {
+    return FALSE;
+  }
+
   //
   // Seed the pseudorandom number generator with user-supplied value.
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.
@@ -78,7 +82,7 @@ RandomBytes (
   //
   // Check input parameters.
   //
-  if (Output == NULL) {
+  if (Output == NULL || Size > INT_MAX) {
     return FALSE;
   }
 
diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandItc.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandItc.c
index 881141cd08..dcc1853f13 100644
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandItc.c
+++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandItc.c
@@ -41,6 +41,10 @@ RandomSeed (
 {
   CHAR8  DefaultSeed[128];
 
+  if (SeedSize > INT_MAX) {
+    return FALSE;
+  }
+
   //
   // Seed the pseudorandom number generator with user-supplied value.
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.
@@ -86,7 +90,7 @@ RandomBytes (
   //
   // Check input parameters.
   //
-  if (Output == NULL) {
+  if (Output == NULL || Size > INT_MAX) {
     return FALSE;
   }
 
diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
index bb8783d354..7259ed50da 100644
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
+++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
@@ -41,6 +41,10 @@ RandomSeed (
 {
   CHAR8  DefaultSeed[128];
 
+  if (SeedSize > INT_MAX) {
+    return FALSE;
+  }
+
   //
   // Seed the pseudorandom number generator with user-supplied value.
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.
@@ -86,7 +90,7 @@ RandomBytes (
   //
   // Check input parameters.
   //
-  if (Output == NULL) {
+  if (Output == NULL || Size > INT_MAX) {
     return FALSE;
   }