MdeModulePkg: Check received packet size before use it.

Arbitrary length of packet may be received from network, including the
packets with zero payload data or malformed protocol header. So the code
much check the actually received data size before using it. For example, in
current edk2 network stack, an zero payload UDP packet may cause the
platform ASSERT in NetbufFromExt() because of the zero fragment number.
This patch update the IpIoLib and UdpIoLib to check and discard the zero
payload data packet to avoid above assert. Some other network drivers are
also updated to check the packet size to guarantee the minimum length of
protocol header is received from upper layer driver.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Sriram Subramanian <sriram-s@hpe.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>

3 files changed, 39 insertions, 5 deletions

diff --git a/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c b/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
index 633c3e7d38..afe4929878 100644
--- a/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
+++ b/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
@@ -1,7 +1,7 @@
 /** @file

   The implementation of the ARP protocol.

   

-Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials

 are licensed and made available under the terms and conditions of the BSD License

 which accompanies this distribution.  The full text of the license may be found at<BR>

@@ -112,15 +112,28 @@ ArpOnFrameRcvdDpc (
   // Status is EFI_SUCCESS, process the received frame.

   //

   RxData = RxToken->Packet.RxData;

-  Head   = (ARP_HEAD *) RxData->PacketData;

+  //

+  // Sanity check.

+  //

+  if (RxData->DataLength < sizeof (ARP_HEAD)) {

+    //

+    // Restart the receiving if packet size is not correct.

+    //

+    goto RESTART_RECEIVE;

+  }

 

   //

   // Convert the byte order of the multi-byte fields.

   //

+  Head   = (ARP_HEAD *) RxData->PacketData;

   Head->HwType    = NTOHS (Head->HwType);

   Head->ProtoType = NTOHS (Head->ProtoType);

   Head->OpCode    = NTOHS (Head->OpCode);

 

+  if (RxData->DataLength < (sizeof (ARP_HEAD) + 2 * Head->HwAddrLen + 2 * Head->ProtoAddrLen)) {

+    goto RESTART_RECEIVE;

+  }

+

   if ((Head->HwType != ArpService->SnpMode.IfType) ||

     (Head->HwAddrLen != ArpService->SnpMode.HwAddressSize) ||

     (RxData->ProtocolType != ARP_ETHER_PROTO_TYPE)) {

diff --git a/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c b/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c
index 209127d18f..11936ad7f1 100644
--- a/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c
+++ b/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c
@@ -1,7 +1,7 @@
 /** @file

   TCP input process routines.

 

-Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2005 - 2016, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials

 are licensed and made available under the terms and conditions of the BSD License

 which accompanies this distribution.  The full text of the license may be found at

@@ -711,12 +711,18 @@ TcpInput (
 

   Head    = (TCP_HEAD *) NetbufGetByte (Nbuf, 0, NULL);

   ASSERT (Head != NULL);

+

+  if (Nbuf->TotalSize < sizeof (TCP_HEAD)) {

+    DEBUG ((EFI_D_INFO, "TcpInput: received a malformed packet\n"));

+    goto DISCARD;

+  }

+  

   Len     = Nbuf->TotalSize - (Head->HeadLen << 2);

 

   if ((Head->HeadLen < 5) || (Len < 0) ||

       (TcpChecksum (Nbuf, NetPseudoHeadChecksum (Src, Dst, 6, 0)) != 0)) {

 

-    DEBUG ((EFI_D_INFO, "TcpInput: received an mal-formated packet\n"));

+    DEBUG ((EFI_D_INFO, "TcpInput: received a malformed packet\n"));

     goto DISCARD;

   }

 

@@ -1423,6 +1429,10 @@ TcpIcmpInput (
   BOOLEAN          IcmpErrIsHard;

   BOOLEAN          IcmpErrNotify;

 

+  if (Nbuf->TotalSize < sizeof (TCP_HEAD)) {

+    goto CLEAN_EXIT;

+  }

+

   Head = (TCP_HEAD *) NetbufGetByte (Nbuf, 0, NULL);

   ASSERT (Head != NULL);

   Tcb = TcpLocateTcb (

diff --git a/MdeModulePkg/Universal/Network/Udp4Dxe/Udp4Impl.c b/MdeModulePkg/Universal/Network/Udp4Dxe/Udp4Impl.c
index 4f077d6b96..df95077aac 100644
--- a/MdeModulePkg/Universal/Network/Udp4Dxe/Udp4Impl.c
+++ b/MdeModulePkg/Universal/Network/Udp4Dxe/Udp4Impl.c
@@ -1,7 +1,7 @@
 /** @file

   The implementation of the Udp4 protocol.

   

-Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2006 - 2016 Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials

 are licensed and made available under the terms and conditions of the BSD License

 which accompanies this distribution.  The full text of the license may be found at

@@ -1608,6 +1608,11 @@ Udp4Demultiplex (
   EFI_UDP4_SESSION_DATA  *Udp4Session;

   UINTN                  Enqueued;

 

+  if (Packet->TotalSize < sizeof (EFI_UDP_HEADER)) {

+    NetbufFree (Packet);

+    return;

+  }

+

   //

   // Get the datagram header from the packet buffer.

   //

@@ -1629,6 +1634,7 @@ Udp4Demultiplex (
       //

       // Wrong checksum.

       //

+      NetbufFree (Packet);

       return;

     }

   }

@@ -1797,6 +1803,11 @@ Udp4IcmpHandler (
   LIST_ENTRY             *Entry;

   UDP4_INSTANCE_DATA     *Instance;

 

+  if (Packet->TotalSize < sizeof (EFI_UDP_HEADER)) {

+    NetbufFree (Packet);

+    return;

+  }

+  

   Udp4Header = (EFI_UDP_HEADER *) NetbufGetByte (Packet, 0, NULL);

   ASSERT (Udp4Header != NULL);