diff options
| author | Samer El-Haj-Mahmoud <elhaj@hpe.com> | 2016-03-04 15:18:49 +0800 |
|---|---|---|
| committer | Fu Siyuan <siyuan.fu@intel.com> | 2016-03-04 15:20:58 +0800 |
| commit | 4f0f2316ed7699e233b362b83c7fbd63c2adf97e (patch) | |
| tree | 561f8fd94dd49f8607cc0da453904d2a44d77034 /MdeModulePkg/Universal/Network | |
| parent | 8a45f80edad4e2e1e23118833f92df4320b123ab (diff) | |
| download | edk2-platforms-4f0f2316ed7699e233b362b83c7fbd63c2adf97e.tar.xz | |
MdeModulePkg: Fix IPv4 double free
Fix a possible ASSERT after NBP finishes loading from a PXE
boot. Ip4Dxe driver calls Ip4Config2SetPolicy which calls
CloseEvent on the Dhcp4Event struct member. After NBP is
downloaded, it then calls Ip4Config2CleanInstance which calls
CloseEvent again on Dhcp4Event. This double free can cause an
ASSERT. When the event is closed, set the event pointer to NULL
so the Ip4 code won't call CloseEvent on it again.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Samer El-Haj-Mahmoud <elhaj@hpe.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Diffstat (limited to 'MdeModulePkg/Universal/Network')
| -rw-r--r-- | MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Config2Impl.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Config2Impl.c b/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Config2Impl.c index 1f763b6bfe..17e0247832 100644 --- a/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Config2Impl.c +++ b/MdeModulePkg/Universal/Network/Ip4Dxe/Ip4Config2Impl.c @@ -2,7 +2,7 @@ The implementation of EFI IPv4 Configuration II Protocol.
Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
- (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
+ (C) Copyright 2015-2016 Hewlett Packard Enterprise Development LP<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
@@ -1194,6 +1194,7 @@ Ip4Config2SetPolicy ( //
if (Instance->Dhcp4Event != NULL) {
gBS->CloseEvent (Instance->Dhcp4Event);
+ Instance->Dhcp4Event = NULL;
}
}
}
@@ -1997,6 +1998,7 @@ Ip4Config2CleanInstance ( //
if (Instance->Dhcp4Event != NULL) {
gBS->CloseEvent (Instance->Dhcp4Event);
+ Instance->Dhcp4Event = NULL;
}
for (Index = 0; Index < Ip4Config2DataTypeMaximum; Index++) {
|