From 1f161a7915e1c2c65bfaf7091712e9628107b707 Mon Sep 17 00:00:00 2001
From: Michael Kubacki <michael.kubacki@microsoft.com>
Date: Thu, 15 Feb 2024 14:16:55 -0500
Subject: MdeModulePkg/Bus/Usb/UsbNetwork: Check array index range before
 access

Checks that an offset used to access array elements is within the
expected range before accessing the array item.

Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Rebecca Cran <rebecca@bsdio.com>
Cc: Richard Ho <richardho@ami.com>
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
---
 MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcEcm/UsbEcmFunction.c  | 2 +-
 MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcNcm/UsbNcmFunction.c  | 2 +-
 MdeModulePkg/Bus/Usb/UsbNetwork/UsbRndis/UsbRndisFunction.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcEcm/UsbEcmFunction.c b/MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcEcm/UsbEcmFunction.c
index 29f4508a38..0c1f252b85 100644
--- a/MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcEcm/UsbEcmFunction.c
+++ b/MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcEcm/UsbEcmFunction.c
@@ -769,7 +769,7 @@ ConvertFilter (
 
   Count = sizeof (gTable)/sizeof (gTable[0]);
 
-  for (Index = 0; (gTable[Index].Src != 0) && (Index < Count); Index++) {
+  for (Index = 0; (Index < Count) && (gTable[Index].Src != 0); Index++) {
     if (gTable[Index].Src & Value) {
       *CdcFilter |= gTable[Index].Dst;
     }
diff --git a/MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcNcm/UsbNcmFunction.c b/MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcNcm/UsbNcmFunction.c
index baa2225bf8..ef01a6f545 100644
--- a/MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcNcm/UsbNcmFunction.c
+++ b/MdeModulePkg/Bus/Usb/UsbNetwork/UsbCdcNcm/UsbNcmFunction.c
@@ -855,7 +855,7 @@ ConvertFilter (
 
   Count = sizeof (gTable)/sizeof (gTable[0]);
 
-  for (Index = 0; (gTable[Index].Src != 0) && (Index < Count); Index++) {
+  for (Index = 0; (Index < Count) && (gTable[Index].Src != 0); Index++) {
     if (gTable[Index].Src & Value) {
       *CdcFilter |= gTable[Index].Dst;
     }
diff --git a/MdeModulePkg/Bus/Usb/UsbNetwork/UsbRndis/UsbRndisFunction.c b/MdeModulePkg/Bus/Usb/UsbNetwork/UsbRndis/UsbRndisFunction.c
index 2c0dcae4cf..6d45a1b775 100644
--- a/MdeModulePkg/Bus/Usb/UsbNetwork/UsbRndis/UsbRndisFunction.c
+++ b/MdeModulePkg/Bus/Usb/UsbNetwork/UsbRndis/UsbRndisFunction.c
@@ -803,7 +803,7 @@ ConvertFilter (
 
   Count = sizeof (gTable)/sizeof (gTable[0]);
 
-  for (Index = 0; (gTable[Index].Src != 0) && (Index < Count); Index++) {
+  for (Index = 0; (Index < Count) && (gTable[Index].Src != 0); Index++) {
     if (gTable[Index].Src & Value) {
       *CdcFilter |= gTable[Index].Dst;
     }
-- 
cgit v1.2.3