From 1b31acb66c026f2791c959a4ec9b55c04d583c22 Mon Sep 17 00:00:00 2001 From: Fu Siyuan Date: Mon, 28 Mar 2016 11:00:31 +0800 Subject: MdeModulePkg: Check received packet size before use it. Arbitrary length of packet may be received from network, including the packets with zero payload data or malformed protocol header. So the code much check the actually received data size before using it. For example, in current edk2 network stack, an zero payload UDP packet may cause the platform ASSERT in NetbufFromExt() because of the zero fragment number. This patch update the IpIoLib and UdpIoLib to check and discard the zero payload data packet to avoid above assert. Some other network drivers are also updated to check the packet size to guarantee the minimum length of protocol header is received from upper layer driver. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Fu Siyuan Reviewed-by: Sriram Subramanian Reviewed-by: Wu Jiaxin --- MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) (limited to 'MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c') diff --git a/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c b/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c index 209127d18f..11936ad7f1 100644 --- a/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c +++ b/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c @@ -1,7 +1,7 @@ /** @file TCP input process routines. -Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved.
+Copyright (c) 2005 - 2016, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -711,12 +711,18 @@ TcpInput ( Head = (TCP_HEAD *) NetbufGetByte (Nbuf, 0, NULL); ASSERT (Head != NULL); + + if (Nbuf->TotalSize < sizeof (TCP_HEAD)) { + DEBUG ((EFI_D_INFO, "TcpInput: received a malformed packet\n")); + goto DISCARD; + } + Len = Nbuf->TotalSize - (Head->HeadLen << 2); if ((Head->HeadLen < 5) || (Len < 0) || (TcpChecksum (Nbuf, NetPseudoHeadChecksum (Src, Dst, 6, 0)) != 0)) { - DEBUG ((EFI_D_INFO, "TcpInput: received an mal-formated packet\n")); + DEBUG ((EFI_D_INFO, "TcpInput: received a malformed packet\n")); goto DISCARD; } @@ -1423,6 +1429,10 @@ TcpIcmpInput ( BOOLEAN IcmpErrIsHard; BOOLEAN IcmpErrNotify; + if (Nbuf->TotalSize < sizeof (TCP_HEAD)) { + goto CLEAN_EXIT; + } + Head = (TCP_HEAD *) NetbufGetByte (Nbuf, 0, NULL); ASSERT (Head != NULL); Tcb = TcpLocateTcb ( -- cgit v1.2.3