From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 0048C823EA for ; Thu, 22 Dec 2016 19:14:51 -0800 (PST) Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga103.jf.intel.com with ESMTP; 22 Dec 2016 19:14:51 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.33,391,1477983600"; d="scan'208";a="46289824" Received: from jiaxinwu-mobl2.ccr.corp.intel.com ([10.239.196.83]) by fmsmga006.fm.intel.com with ESMTP; 22 Dec 2016 19:14:50 -0800 From: Jiaxin Wu To: edk2-devel@lists.01.org Cc: Ye Ting , Fu Siyuan , Wu Hao A , Wu Jiaxin Date: Fri, 23 Dec 2016 11:14:48 +0800 Message-Id: <1482462888-305872-1-git-send-email-jiaxin.wu@intel.com> X-Mailer: git-send-email 1.9.5.msysgit.1 Subject: [Patch] NetworkPkg/HttpDxe: Fix the potential NULL dereference X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Dec 2016 03:14:52 -0000 Cc: Ye Ting Cc: Fu Siyuan Cc: Wu Hao A Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin --- NetworkPkg/HttpDxe/HttpImpl.c | 4 ++- NetworkPkg/HttpDxe/HttpProto.c | 6 +++- NetworkPkg/HttpDxe/HttpsSupport.c | 74 +++++++++++++++++++++++++++------------ 3 files changed, 60 insertions(+), 24 deletions(-) diff --git a/NetworkPkg/HttpDxe/HttpImpl.c b/NetworkPkg/HttpDxe/HttpImpl.c index 77aa64a..d19f733 100644 --- a/NetworkPkg/HttpDxe/HttpImpl.c +++ b/NetworkPkg/HttpDxe/HttpImpl.c @@ -589,14 +589,16 @@ EfiHttpRequest ( } } Status = HttpGenRequestMessage (HttpMsg, FileUrl, &RequestMsg, &RequestMsgSize); - if (EFI_ERROR (Status)) { + if (EFI_ERROR (Status) || NULL == RequestMsg) { goto Error3; } + ASSERT (RequestMsg != NULL); + // // Every request we insert a TxToken and a response call would remove the TxToken. // In cases of PUT/POST, after an initial request-response pair, we would do a // continuous request without a response call. So, in such cases, where Request // structure is NULL, we would not insert a TxToken. diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c index 36c61e2..199d575 100644 --- a/NetworkPkg/HttpDxe/HttpProto.c +++ b/NetworkPkg/HttpDxe/HttpProto.c @@ -1653,10 +1653,12 @@ HttpTcpTransmit ( CHAR8 *RequestMsg; CHAR8 *Url; UINTN UrlSize; UINTN RequestMsgSize; + RequestMsg = NULL; + ValueInItem = (HTTP_TOKEN_WRAP *) Item->Value; if (ValueInItem->TcpWrap.IsTxDone) { return EFI_SUCCESS; } @@ -1680,14 +1682,16 @@ HttpTcpTransmit ( &RequestMsg, &RequestMsgSize ); FreePool (Url); - if (EFI_ERROR (Status)){ + if (EFI_ERROR (Status) || NULL == RequestMsg){ return Status; } + ASSERT (RequestMsg != NULL); + // // Transmit the request message. // Status = HttpTransmitTcp ( ValueInItem->HttpInstance, diff --git a/NetworkPkg/HttpDxe/HttpsSupport.c b/NetworkPkg/HttpDxe/HttpsSupport.c index 478a9e0..c9e6988 100644 --- a/NetworkPkg/HttpDxe/HttpsSupport.c +++ b/NetworkPkg/HttpDxe/HttpsSupport.c @@ -399,37 +399,41 @@ TlsConfigCertificate ( NULL, &CACertSize, NULL ); - if (Status == EFI_BUFFER_TOO_SMALL) { + if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) { + return Status; + } + + // + // Allocate buffer and read the config variable. + // + CACert = AllocatePool (CACertSize); + if (CACert == NULL) { + return EFI_OUT_OF_RESOURCES; + } + + Status = gRT->GetVariable ( + EFI_TLS_CA_CERTIFICATE_VARIABLE, + &gEfiTlsCaCertificateGuid, + NULL, + &CACertSize, + CACert + ); + if (EFI_ERROR (Status)) { // - // Allocate buffer and read the config variable. + // GetVariable still error or the variable is corrupted. + // Fall back to the default value. // - CACert = AllocatePool (CACertSize); - if (CACert == NULL) { - return EFI_OUT_OF_RESOURCES; - } - - Status = gRT->GetVariable ( - EFI_TLS_CA_CERTIFICATE_VARIABLE, - &gEfiTlsCaCertificateGuid, - NULL, - &CACertSize, - CACert - ); - if (EFI_ERROR (Status)) { - // - // GetVariable still error or the variable is corrupted. - // Fall back to the default value. - // - FreePool (CACert); + FreePool (CACert); - return EFI_NOT_FOUND; - } + return EFI_NOT_FOUND; } + ASSERT (CACert != NULL); + // // Enumerate all data and erasing the target item. // ItemDataSize = (UINT32) CACertSize; CertList = (EFI_SIGNATURE_LIST *) CACert; @@ -1035,10 +1039,15 @@ TlsConnectSession ( // // Transmit ClientHello // PacketOut = NetbufAlloc ((UINT32) BufferOutSize); DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL); + if (DataOut == NULL) { + FreePool (BufferOut); + return EFI_OUT_OF_RESOURCES; + } + CopyMem (DataOut, BufferOut, BufferOutSize); Status = TlsCommonTransmit (HttpInstance, PacketOut); FreePool (BufferOut); NetbufFree (PacketOut); @@ -1105,19 +1114,25 @@ TlsConnectSession ( } FreePool (BufferIn); if (EFI_ERROR (Status)) { + FreePool (BufferOut); return Status; } if (BufferOutSize != 0) { // // Transmit the response packet. // PacketOut = NetbufAlloc ((UINT32) BufferOutSize); DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL); + if (DataOut == NULL) { + FreePool (BufferOut); + return EFI_OUT_OF_RESOURCES; + } + CopyMem (DataOut, BufferOut, BufferOutSize); Status = TlsCommonTransmit (HttpInstance, PacketOut); NetbufFree (PacketOut); @@ -1265,10 +1280,15 @@ TlsCloseSession ( return Status; } PacketOut = NetbufAlloc ((UINT32) BufferOutSize); DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL); + if (DataOut == NULL) { + FreePool (BufferOut); + return EFI_OUT_OF_RESOURCES; + } + CopyMem (DataOut, BufferOut, BufferOutSize); Status = TlsCommonTransmit (HttpInstance, PacketOut); FreePool (BufferOut); @@ -1538,10 +1558,15 @@ HttpsReceive ( } if (BufferOutSize != 0) { PacketOut = NetbufAlloc ((UINT32)BufferOutSize); DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL); + if (DataOut == NULL) { + FreePool (BufferOut); + return EFI_OUT_OF_RESOURCES; + } + CopyMem (DataOut, BufferOut, BufferOutSize); Status = TlsCommonTransmit (HttpInstance, PacketOut); NetbufFree (PacketOut); @@ -1625,10 +1650,15 @@ HttpsReceive ( } if (BufferOutSize != 0) { PacketOut = NetbufAlloc ((UINT32) BufferOutSize); DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL); + if (DataOut == NULL) { + FreePool (BufferOut); + return EFI_OUT_OF_RESOURCES; + } + CopyMem (DataOut, BufferOut, BufferOutSize); Status = TlsCommonTransmit (HttpInstance, PacketOut); NetbufFree (PacketOut); -- 1.9.5.msysgit.1