From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <hao.a.wu@intel.com>
Received: from mga05.intel.com (mga05.intel.com [192.55.52.43])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by ml01.01.org (Postfix) with ESMTPS id 025CE821E1
 for <edk2-devel@lists.01.org>; Sun, 19 Feb 2017 19:02:41 -0800 (PST)
Received: from fmsmga004.fm.intel.com ([10.253.24.48])
 by fmsmga105.fm.intel.com with ESMTP; 19 Feb 2017 19:02:41 -0800
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.35,184,1484035200"; d="scan'208";a="227326335"
Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13])
 by fmsmga004.fm.intel.com with ESMTP; 19 Feb 2017 19:02:40 -0800
From: Hao Wu <hao.a.wu@intel.com>
To: edk2-devel@lists.01.org
Cc: Hao Wu <hao.a.wu@intel.com>, Wu Jiaxin <jiaxin.wu@intel.com>,
 Siyuan Fu <siyuan.fu@intel.com>
Date: Mon, 20 Feb 2017 11:02:38 +0800
Message-Id: <1487559758-54048-1-git-send-email-hao.a.wu@intel.com>
X-Mailer: git-send-email 1.9.5.msysgit.0
Subject: [PATCH] NetworkPkg/IpSecDxe: Add check to avoid possible divide by zero
X-BeenThere: edk2-devel@lists.01.org
X-Mailman-Version: 2.1.21
Precedence: list
List-Id: EDK II Development  <edk2-devel.lists.01.org>
List-Unsubscribe: <https://lists.01.org/mailman/options/edk2-devel>,
 <mailto:edk2-devel-request@lists.01.org?subject=unsubscribe>
List-Archive: <http://lists.01.org/pipermail/edk2-devel/>
List-Post: <mailto:edk2-devel@lists.01.org>
List-Help: <mailto:edk2-devel-request@lists.01.org?subject=help>
List-Subscribe: <https://lists.01.org/mailman/listinfo/edk2-devel>,
 <mailto:edk2-devel-request@lists.01.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Feb 2017 03:02:42 -0000

Cc: Wu Jiaxin <jiaxin.wu@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
 NetworkPkg/IpSecDxe/Ikev2/Utility.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Utility.c b/NetworkPkg/IpSecDxe/Ikev2/Utility.c
index c365532..2ca7f3c 100644
--- a/NetworkPkg/IpSecDxe/Ikev2/Utility.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Utility.c
@@ -2,7 +2,7 @@
   The Common operations used by IKE Exchange Process.
 
   (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
-  Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -2627,6 +2627,8 @@ Ikev2ChildSaParseSaPayload (
 
   @retval EFI_SUCCESS            The operation complete successfully.
   @retval EFI_INVALID_PARAMETER  If NumFragments is zero.
+                                 If the authentication algorithm given by HashAlgId
+                                 cannot be found.
   @retval EFI_OUT_OF_RESOURCES   If the required resource can't be allocated.
   @retval Others                 The operation is failed.
 
@@ -2663,6 +2665,10 @@ Ikev2SaGenerateKey (
   LocalFragments[2].Data = NULL;
 
   AuthKeyLength = IpSecGetHmacDigestLength (HashAlgId);
+  if (AuthKeyLength == 0) {
+    return EFI_INVALID_PARAMETER;
+  }
+
   DigestSize    = AuthKeyLength;
   Digest        = AllocateZeroPool (AuthKeyLength);
 
-- 
1.9.5.msysgit.0