From 59844e126614fc8275aab083fafa5818cde0901c Mon Sep 17 00:00:00 2001 From: Jiaxin Wu Date: Wed, 27 Apr 2016 14:29:29 +0800 Subject: NetworkPkg: Fix incorrect buffer free in HttpDxe FragmentBuffer of each TcpWrap in HttpDxe should not be freed in HttpTcpTokenCleanup(). This buffer points to HttpMsg body actually, which is the responsibility of the caller to allocate a buffer for Body. Cc: Ye Ting Cc: Fu Siyuan Cc: Zhang Lubo Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Jiaxin Wu Reviewed-by: Ye Ting --- NetworkPkg/HttpDxe/HttpProto.c | 44 +++++++++++++++++++++--------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c index 06f3bb6860..f3992edfdc 100644 --- a/NetworkPkg/HttpDxe/HttpProto.c +++ b/NetworkPkg/HttpDxe/HttpProto.c @@ -1837,45 +1837,45 @@ HttpTcpTokenCleanup ( Rx6Token = NULL; if (HttpInstance->LocalAddressIsIPv6) { - if (Wrap->TcpWrap.Rx6Token.CompletionToken.Event != NULL) { - gBS->CloseEvent (Wrap->TcpWrap.Rx6Token.CompletionToken.Event); - } - Rx6Token = &Wrap->TcpWrap.Rx6Token; - if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) { - FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer); - Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL; + + if (Rx6Token->CompletionToken.Event != NULL) { + gBS->CloseEvent (Rx6Token->CompletionToken.Event); + Rx6Token->CompletionToken.Event = NULL; } - FreePool (Wrap); - if (HttpInstance->Rx6Token.CompletionToken.Event != NULL) { - gBS->CloseEvent (HttpInstance->Rx6Token.CompletionToken.Event); - HttpInstance->Rx6Token.CompletionToken.Event = NULL; - } + FreePool (Wrap); Rx6Token = &HttpInstance->Rx6Token; + + if (Rx6Token->CompletionToken.Event != NULL) { + gBS->CloseEvent (Rx6Token->CompletionToken.Event); + Rx6Token->CompletionToken.Event = NULL; + } + if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) { FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer); Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL; } } else { - if (Wrap->TcpWrap.Rx4Token.CompletionToken.Event != NULL) { - gBS->CloseEvent (Wrap->TcpWrap.Rx4Token.CompletionToken.Event); - } Rx4Token = &Wrap->TcpWrap.Rx4Token; - if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) { - FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer); - Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL; + + if (Rx4Token->CompletionToken.Event != NULL) { + gBS->CloseEvent (Rx4Token->CompletionToken.Event); + Rx4Token->CompletionToken.Event = NULL; } + FreePool (Wrap); - if (HttpInstance->Rx4Token.CompletionToken.Event != NULL) { - gBS->CloseEvent (HttpInstance->Rx4Token.CompletionToken.Event); - HttpInstance->Rx4Token.CompletionToken.Event = NULL; + Rx4Token = &HttpInstance->Rx4Token; + + if (Rx4Token->CompletionToken.Event != NULL) { + gBS->CloseEvent (Rx4Token->CompletionToken.Event); + Rx4Token->CompletionToken.Event = NULL; } - Rx4Token = &HttpInstance->Rx4Token; + if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) { FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer); Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL; -- cgit v1.2.3