diff options
| author | Jiaxin Wu <jiaxin.wu@intel.com> | 2017-04-12 16:36:11 +0800 |
|---|---|---|
| committer | Guo Mang <mang.guo@intel.com> | 2017-07-12 11:24:23 +0800 |
| commit | 9e63ff6686c0189a854817894ed443af7569f83c (patch) | |
| tree | 2f3b43baad10d9fba729f06d0e711a8924564956 | |
| parent | 823c127db474f5a28a0345c4a1535136aac6a036 (diff) | |
| download | edk2-platforms-9e63ff6686c0189a854817894ed443af7569f83c.tar.xz | |
NetworkPkg/HttpDxe: Fix HTTP download OS image over 4G size failure
UINT32 integer overflow will happen once the download OS image over
4G size. This patch is to fix this issue.
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Zhang Lubo <lubo.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Sriram Subramanian <sriram-s@hpe.com>
(cherry picked from commit 6893b16fb9f8afef71ae4e9e3dead6bb685f6994)
| -rw-r--r-- | Core/NetworkPkg/HttpDxe/HttpProto.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/Core/NetworkPkg/HttpDxe/HttpProto.c b/Core/NetworkPkg/HttpDxe/HttpProto.c index 3d61ba2ae1..3fda294be3 100644 --- a/Core/NetworkPkg/HttpDxe/HttpProto.c +++ b/Core/NetworkPkg/HttpDxe/HttpProto.c @@ -2031,8 +2031,8 @@ HttpTcpReceiveBody ( if (HttpInstance->LocalAddressIsIPv6) {
Rx6Token = &Wrap->TcpWrap.Rx6Token;
- Rx6Token ->Packet.RxData->DataLength = (UINT32) HttpMsg->BodyLength;
- Rx6Token ->Packet.RxData->FragmentTable[0].FragmentLength = (UINT32) HttpMsg->BodyLength;
+ Rx6Token ->Packet.RxData->DataLength = (UINT32) MIN (MAX_UINT32, HttpMsg->BodyLength);
+ Rx6Token ->Packet.RxData->FragmentTable[0].FragmentLength = (UINT32) MIN (MAX_UINT32, HttpMsg->BodyLength);
Rx6Token ->Packet.RxData->FragmentTable[0].FragmentBuffer = (VOID *) HttpMsg->Body;
Rx6Token->CompletionToken.Status = EFI_NOT_READY;
@@ -2043,8 +2043,8 @@ HttpTcpReceiveBody ( }
} else {
Rx4Token = &Wrap->TcpWrap.Rx4Token;
- Rx4Token->Packet.RxData->DataLength = (UINT32) HttpMsg->BodyLength;
- Rx4Token->Packet.RxData->FragmentTable[0].FragmentLength = (UINT32) HttpMsg->BodyLength;
+ Rx4Token->Packet.RxData->DataLength = (UINT32) MIN (MAX_UINT32, HttpMsg->BodyLength);
+ Rx4Token->Packet.RxData->FragmentTable[0].FragmentLength = (UINT32) MIN (MAX_UINT32, HttpMsg->BodyLength);
Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = (VOID *) HttpMsg->Body;
Rx4Token->CompletionToken.Status = EFI_NOT_READY;
|