Fix undefined behavior and NULL pointer in boot loader OS list renderer

sdk/xtdk/bltypes.h

@@ -45,7 +45,7 @@ typedef LONG (*PBL_GET_MEMTYPE_ROUTINE)(IN LONG EfiMemoryType);
 /* Boot Loader protocol routine pointers */
 typedef EFI_STATUS (*PBL_ALLOCATE_PAGES)(IN ULONGLONG Size, OUT PEFI_PHYSICAL_ADDRESS Memory);
 typedef EFI_STATUS (*PBL_ALLOCATE_POOL)(IN UINT_PTR Size, OUT PVOID *Memory);
-typedef VOID (*PBL_BOOTMENU_INITIALIZE_OS_LIST)(OUT PXTBL_BOOTMENU_ITEM MenuEntries, OUT PULONG EntriesCount, OUT PULONG DefaultId);
+typedef EFI_STATUS (*PBL_BOOTMENU_INITIALIZE_OS_LIST)(OUT PXTBL_BOOTMENU_ITEM *MenuEntries, OUT PULONG EntriesCount, OUT PULONG DefaultId);
 typedef EFI_STATUS (*PBL_BUILD_PAGE_MAP)(IN PXTBL_PAGE_MAPPING PageMap, IN ULONG_PTR SelfMapAddress);
 typedef EFI_STATUS (*PBL_CLOSE_VOLUME)(IN PEFI_HANDLE VolumeHandle);
 typedef VOID (*PBL_CLEAR_CONSOLE_LINE)(IN ULONGLONG LineNo);

xtldr/includes/xtldr.h

@@ -190,8 +190,8 @@ VOID
 BlInitializeBootLoader();
 
 XTCDECL
-VOID
-BlInitializeBootMenuList(OUT PXTBL_BOOTMENU_ITEM MenuEntries,
+EFI_STATUS
+BlInitializeBootMenuList(OUT PXTBL_BOOTMENU_ITEM *MenuEntries,
                          OUT PULONG EntriesCount,
                          OUT PULONG DefaultId);
 

xtldr/textui.c

@@ -32,7 +32,12 @@ BlDisplayBootMenu()
     PWCHAR TimeOutString;
 
     /* Initialize boot menu list */
-    BlInitializeBootMenuList(MenuEntries, &NumberOfEntries, &HighligtedEntryId);
+    Status = BlInitializeBootMenuList(&MenuEntries, &NumberOfEntries, &HighligtedEntryId);
+    if(Status != STATUS_EFI_SUCCESS)
+    {
+        /* Failed to initialize boot menu list, exit into XTLDR shell */
+        return;
+    }
 
     /* Get timeout from the configuration */
     TimeOutString = BlGetConfigValue(L"TIMEOUT");

xtldr/xtldr.c

@@ -89,8 +89,8 @@ BlInitializeBootLoader()
  * @since XT 1.0
  */
 XTCDECL
-VOID
-BlInitializeBootMenuList(OUT PXTBL_BOOTMENU_ITEM MenuEntries,
+EFI_STATUS
+BlInitializeBootMenuList(OUT PXTBL_BOOTMENU_ITEM *MenuEntries,
                          OUT PULONG EntriesCount,
                          OUT PULONG DefaultId)
 {
@@ -106,7 +106,6 @@ BlInitializeBootMenuList(OUT PXTBL_BOOTMENU_ITEM MenuEntries,
     /* Set default values */
     DefaultOS = 0;
     NumberOfEntries = 0;
-    OsList = NULL;
 
     /* Get default menu entry from configuration */
     DefaultMenuEntry = BlGetConfigValue(L"DEFAULT");
@@ -123,7 +122,25 @@ BlInitializeBootMenuList(OUT PXTBL_BOOTMENU_ITEM MenuEntries,
         }
     }
 
-    /* Iterate through all menu sections */
+    /* Iterate through menu items to get a total number of entries */
+    MenuEntrySectionList = BlpMenuList->Flink;
+    while(MenuEntrySectionList != BlpMenuList)
+    {
+        /* Increase number of menu entries, and simply get next item */
+        NumberOfEntries++;
+        MenuEntrySectionList = MenuEntrySectionList->Flink;
+    }
+
+    /* Allocate memory for the OS list depending on the item count */
+    Status = BlAllocateMemoryPool(NumberOfEntries * sizeof(XTBL_BOOTMENU_ITEM), (PVOID*)&OsList);
+    if(Status != STATUS_EFI_SUCCESS || !OsList)
+    {
+        /* Memory allocation failure */
+        return STATUS_EFI_OUT_OF_RESOURCES;
+    }
+
+    /* Reset counter and iterate through all menu items once again */
+    NumberOfEntries = 0;
     MenuEntrySectionList = BlpMenuList->Flink;
     while(MenuEntrySectionList != BlpMenuList)
     {
@@ -171,7 +188,10 @@ BlInitializeBootMenuList(OUT PXTBL_BOOTMENU_ITEM MenuEntries,
     /* Set return values */
     *DefaultId = DefaultOS;
     *EntriesCount = NumberOfEntries;
-    MenuEntries = OsList;
+    *MenuEntries = OsList;
+
+    /* Return success */
+    return STATUS_EFI_SUCCESS;
 }
 
 /**