diff options
author | Fu Siyuan <siyuan.fu@intel.com> | 2016-03-28 11:01:03 +0800 |
---|---|---|
committer | Fu Siyuan <siyuan.fu@intel.com> | 2016-04-01 13:30:23 +0800 |
commit | 37b680116dcd4a3517cb87794c33fc84beea8dd2 (patch) | |
tree | 72595ee118afd97ef259b1a5eb5a54e5d3850188 /NetworkPkg/Udp6Dxe | |
parent | 1b31acb66c026f2791c959a4ec9b55c04d583c22 (diff) | |
download | edk2-platforms-37b680116dcd4a3517cb87794c33fc84beea8dd2.tar.xz |
NetworkPkg: Check received packet size before use it.
Arbitrary length of packet may be received from network, including the
packets with zero payload data or malformed protocol header. So the code
much check the actually received data size before using it. For example, in
current edk2 network stack, an zero payload UDP packet may cause the
platform ASSERT in NetbufFromExt() because of the zero fragment number.
This patch update the IpIoLib and UdpIoLib to check and discard the zero
payload data packet to avoid above assert. Some other network drivers are
also updated to check the packet size to guarantee the minimum length of
protocol header is received from upper layer driver.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Sriram Subramanian <sriram-s@hpe.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
Diffstat (limited to 'NetworkPkg/Udp6Dxe')
-rw-r--r-- | NetworkPkg/Udp6Dxe/Udp6Impl.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/NetworkPkg/Udp6Dxe/Udp6Impl.c b/NetworkPkg/Udp6Dxe/Udp6Impl.c index 40e3aff069..7ed50411c6 100644 --- a/NetworkPkg/Udp6Dxe/Udp6Impl.c +++ b/NetworkPkg/Udp6Dxe/Udp6Impl.c @@ -1,7 +1,7 @@ /** @file
Udp6 driver's whole implementation.
- Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2009 - 2016 Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
@@ -1598,6 +1598,11 @@ Udp6Demultiplex ( EFI_UDP6_SESSION_DATA *Udp6Session;
UINTN Enqueued;
+ if (Packet->TotalSize < sizeof (EFI_UDP_HEADER)) {
+ NetbufFree (Packet);
+ return;
+ }
+
//
// Get the datagram header from the packet buffer.
//
@@ -1619,6 +1624,7 @@ Udp6Demultiplex ( //
// Wrong checksum.
//
+ NetbufFree (Packet);
return;
}
}
@@ -1834,6 +1840,11 @@ Udp6IcmpHandler ( LIST_ENTRY *Entry;
UDP6_INSTANCE_DATA *Instance;
+ if (Packet->TotalSize < sizeof (EFI_UDP_HEADER)) {
+ NetbufFree (Packet);
+ return;
+ }
+
Udp6Header = (EFI_UDP_HEADER *) NetbufGetByte (Packet, 0, NULL);
ASSERT (Udp6Header != NULL);
|