From: Jiaxin Wu <jiaxin.wu@intel.com>
To: edk2-devel@lists.01.org
Cc: Ye Ting <ting.ye@intel.com>, Fu Siyuan <siyuan.fu@intel.com>,
Wang Fan <fan.wang@intel.com>, Wu Jiaxin <jiaxin.wu@intel.com>
Subject: [Patch 4/4] NetworkPkg/DnsDxe: Avoid to access the freed memory buffer.
Date: Tue, 5 Dec 2017 14:59:22 +0800 [thread overview]
Message-ID: <1512457162-9296-5-git-send-email-jiaxin.wu@intel.com> (raw)
In-Reply-To: <1512457162-9296-1-git-send-email-jiaxin.wu@intel.com>
The HostNameToIp() is a asynchronous function, so the caller
may free the HostName buffer immediately once HostNameToIp()
is returned. Then DNS driver may access the freed memory buffer
later.
This patch is to fix above issue.
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Wang Fan <fan.wang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
---
NetworkPkg/DnsDxe/DnsProtocol.c | 69 +++++++++++++++++++++++------------------
1 file changed, 39 insertions(+), 30 deletions(-)
diff --git a/NetworkPkg/DnsDxe/DnsProtocol.c b/NetworkPkg/DnsDxe/DnsProtocol.c
index df737dc..1fcaabd 100644
--- a/NetworkPkg/DnsDxe/DnsProtocol.c
+++ b/NetworkPkg/DnsDxe/DnsProtocol.c
@@ -462,13 +462,19 @@ Dns4HostNameToIp (
Status = EFI_OUT_OF_RESOURCES;
goto ON_EXIT;
}
TokenEntry->PacketToLive = Token->RetryInterval;
- TokenEntry->QueryHostName = HostName;
TokenEntry->Token = Token;
-
+ TokenEntry->QueryHostName = AllocateZeroPool (StrSize (HostName));
+ if (TokenEntry->QueryHostName == NULL) {
+ Status = EFI_OUT_OF_RESOURCES;
+ goto ON_EXIT;
+ }
+
+ CopyMem (TokenEntry->QueryHostName, HostName, StrSize (HostName));
+
//
// Construct QName.
//
QueryName = NetLibCreateDnsQName (TokenEntry->QueryHostName);
if (QueryName == NULL) {
@@ -478,49 +484,48 @@ Dns4HostNameToIp (
//
// Construct DNS Query Packet.
//
Status = ConstructDNSQuery (Instance, QueryName, DNS_TYPE_A, DNS_CLASS_INET, &Packet);
- if (EFI_ERROR (Status)) {
- if (TokenEntry != NULL) {
- FreePool (TokenEntry);
- }
-
+ if (EFI_ERROR (Status)) {
goto ON_EXIT;
}
ASSERT (Packet != NULL);
//
// Save the token into the Dns4TxTokens map.
//
Status = NetMapInsertTail (&Instance->Dns4TxTokens, TokenEntry, Packet);
if (EFI_ERROR (Status)) {
- if (TokenEntry != NULL) {
- FreePool (TokenEntry);
- }
-
- NetbufFree (Packet);
-
goto ON_EXIT;
}
//
// Dns Query Ip
//
Status = DoDnsQuery (Instance, Packet);
if (EFI_ERROR (Status)) {
Dns4RemoveTokenEntry (&Instance->Dns4TxTokens, TokenEntry);
+ }
+
+ON_EXIT:
+ if (EFI_ERROR (Status)) {
if (TokenEntry != NULL) {
+ if (TokenEntry->QueryHostName != NULL) {
+ FreePool (TokenEntry->QueryHostName);
+ }
+
FreePool (TokenEntry);
}
- NetbufFree (Packet);
+ if (Packet != NULL) {
+ NetbufFree (Packet);
+ }
}
-ON_EXIT:
if (QueryName != NULL) {
FreePool (QueryName);
}
gBS->RestoreTPL (OldTpl);
@@ -1299,13 +1304,18 @@ Dns6HostNameToIp (
Status = EFI_OUT_OF_RESOURCES;
goto ON_EXIT;
}
TokenEntry->PacketToLive = Token->RetryInterval;
- TokenEntry->QueryHostName = HostName;
TokenEntry->Token = Token;
-
+ TokenEntry->QueryHostName = AllocateZeroPool (StrSize (HostName));
+ if (TokenEntry->QueryHostName == NULL) {
+ Status = EFI_OUT_OF_RESOURCES;
+ goto ON_EXIT;
+ }
+
+ CopyMem (TokenEntry->QueryHostName, HostName, StrSize (HostName));
//
// Construct QName.
//
QueryName = NetLibCreateDnsQName (TokenEntry->QueryHostName);
@@ -1317,48 +1327,47 @@ Dns6HostNameToIp (
//
// Construct DNS Query Packet.
//
Status = ConstructDNSQuery (Instance, QueryName, DNS_TYPE_AAAA, DNS_CLASS_INET, &Packet);
if (EFI_ERROR (Status)) {
- if (TokenEntry != NULL) {
- FreePool (TokenEntry);
- }
-
goto ON_EXIT;
}
ASSERT (Packet != NULL);
//
// Save the token into the Dns6TxTokens map.
//
Status = NetMapInsertTail (&Instance->Dns6TxTokens, TokenEntry, Packet);
if (EFI_ERROR (Status)) {
- if (TokenEntry != NULL) {
- FreePool (TokenEntry);
- }
-
- NetbufFree (Packet);
-
goto ON_EXIT;
}
//
// Dns Query Ip
//
Status = DoDnsQuery (Instance, Packet);
if (EFI_ERROR (Status)) {
Dns6RemoveTokenEntry (&Instance->Dns6TxTokens, TokenEntry);
-
+ }
+
+ON_EXIT:
+
+ if (EFI_ERROR (Status)) {
if (TokenEntry != NULL) {
+ if (TokenEntry->QueryHostName != NULL) {
+ FreePool (TokenEntry->QueryHostName);
+ }
+
FreePool (TokenEntry);
}
- NetbufFree (Packet);
+ if (Packet != NULL) {
+ NetbufFree (Packet);
+ }
}
-ON_EXIT:
if (QueryName != NULL) {
FreePool (QueryName);
}
gBS->RestoreTPL (OldTpl);
--
1.9.5.msysgit.1
next prev parent reply other threads:[~2017-12-05 6:55 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-05 6:59 [Patch 0/4] NetworkPkg/DnsDxe: Fix several issues in DnsDxe driver Jiaxin Wu
2017-12-05 6:59 ` [Patch 1/4] NetworkPkg/DnsDxe: Remove the unnecessary if condition check in DNS.Config Jiaxin Wu
2017-12-05 6:59 ` [Patch 2/4] NetworkPkg/DnsDxe: Update RetryCount/RetryInterval to comply with UEFI spec Jiaxin Wu
2017-12-05 6:59 ` [Patch 3/4] NetworkPkg/DnsDxe: Fix the potential memory leak issue Jiaxin Wu
2017-12-05 6:59 ` Jiaxin Wu [this message]
2017-12-05 8:09 ` [Patch 0/4] NetworkPkg/DnsDxe: Fix several issues in DnsDxe driver Fu, Siyuan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1512457162-9296-5-git-send-email-jiaxin.wu@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox