1. In IPv4 and IPv6 driver, before calling IPsec, a new NET_FRAGMENT structure is allocated and then passed to IPsec, it should be released after it is done to avoid the memory leak.

2. In IPsec driver it wrongly use the HeadLen to calculate the IP header length after the IPsec process. Correct this mistake.

Signed-off-by: qianouyang
Reviewed-by: jjin9
Reviewed-by: ZhangCaoIntel

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@11824 6f19259b-4bc3-4df7-8a09-765794883524

2 files changed, 17 insertions, 3 deletions

diff --git a/NetworkPkg/Ip6Dxe/Ip6Input.c b/NetworkPkg/Ip6Dxe/Ip6Input.c
index 89cdc35542..3f0dce7343 100644
--- a/NetworkPkg/Ip6Dxe/Ip6Input.c
+++ b/NetworkPkg/Ip6Dxe/Ip6Input.c
@@ -1,7 +1,7 @@
 /** @file

   IP6 internal functions to process the incoming packets.

 

-  Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>

+  Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>

 

   This program and the accompanying materials

   are licensed and made available under the terms and conditions of the BSD License

@@ -613,6 +613,7 @@ Ip6IpSecProcessPacket (
   Ip6NtohHead (*Head);

 

   if (EFI_ERROR (Status)) {

+    FreePool (OriginalFragmentTable);

     goto ON_EXIT;

   }

 

@@ -620,7 +621,13 @@ Ip6IpSecProcessPacket (
     //

     // For ByPass Packet

     //

+    FreePool (FragmentTable);

     goto ON_EXIT;

+  } else {

+    //

+    // Free the FragmentTable which allocated before calling the IPsec.

+    //

+    FreePool (OriginalFragmentTable);

   }

 

   if (Direction == EfiIPsecOutBound && TxWrap != NULL) {

@@ -634,6 +641,7 @@ Ip6IpSecProcessPacket (
                                    TxWrap

                                    );

     if (TxWrap->Packet == NULL) {

+      TxWrap->Packet = *Netbuf;

       Status = EFI_OUT_OF_RESOURCES;

       goto ON_EXIT;

     }

@@ -652,6 +660,8 @@ Ip6IpSecProcessPacket (
     IpSecWrap = AllocateZeroPool (sizeof (IP6_IPSEC_WRAP));

 

     if (IpSecWrap == NULL) {

+      Status = EFI_OUT_OF_RESOURCES;

+      gBS->SignalEvent (RecycleEvent);

       goto ON_EXIT;

     }

 

@@ -667,6 +677,9 @@ Ip6IpSecProcessPacket (
                                       );

 

     if (Packet == NULL) {

+      Packet = IpSecWrap->Packet;

+      gBS->SignalEvent (RecycleEvent);

+      FreePool (IpSecWrap);

       Status = EFI_OUT_OF_RESOURCES;

       goto ON_EXIT;

     }

@@ -679,7 +692,8 @@ Ip6IpSecProcessPacket (
                                         NET_BUF_HEAD

                                         );

       if (PacketHead == NULL) {

-        Status = EFI_OUT_OF_RESOURCES;

+        *Netbuf = Packet;

+        Status  = EFI_OUT_OF_RESOURCES;

         goto ON_EXIT;

       }

 

diff --git a/NetworkPkg/IpSecDxe/IpSecImpl.c b/NetworkPkg/IpSecDxe/IpSecImpl.c
index 63abfa6ba6..fe3a604ee4 100644
--- a/NetworkPkg/IpSecDxe/IpSecImpl.c
+++ b/NetworkPkg/IpSecDxe/IpSecImpl.c
@@ -1596,7 +1596,7 @@ IpSecEspInboundPacket (
   //

   if (!SadData->Mode == EfiIPsecTunnel) {

     if (IpVersion == IP_VERSION_4) {

-      ((IP4_HEAD *) IpHead)->TotalLen = HTONS ((UINT16) (((IP4_HEAD *) IpHead)->HeadLen + PlainPayloadSize));

+      ((IP4_HEAD *) IpHead)->TotalLen = HTONS ((UINT16) ((((IP4_HEAD *) IpHead)->HeadLen << 2) + PlainPayloadSize));

     } else {

       IpSecHeadSize                              = IpSecGetPlainExtHeadSize (IpHead, LastHead);

       ((EFI_IP6_HEADER *) IpHead)->PayloadLength = HTONS ((UINT16)(IpSecHeadSize + PlainPayloadSize));