From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by mx.groups.io with SMTP id smtpd.web12.2450.1585818880058249275 for ; Thu, 02 Apr 2020 02:14:40 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=none, err=permanent DNS error (domain: linux.intel.com, ip: 134.134.136.65, mailfrom: maciej.rabeda@linux.intel.com) IronPort-SDR: aWrnqOkSsMWMt/9ce+cYIqb7No4wN1wtpIQFmjGEg0zpVTSdbrMmqeUTZbV2G3j4yWPd6HxHUI V8lZN01h1mvQ== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Apr 2020 02:14:39 -0700 IronPort-SDR: n+x3ifmKPqGypBi5LNC58ndfQjIIAGCoeKS+K26EFzjGrbz45wI5Tdo9aRRb6rC3WeBft8A0t2 Q+At+27qKeiw== X-IronPort-AV: E=Sophos;i="5.72,335,1580803200"; d="scan'208";a="252932860" Received: from mrabeda-mobl.ger.corp.intel.com ([10.213.18.84]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Apr 2020 02:14:38 -0700 From: "Maciej Rabeda" To: devel@edk2.groups.io Cc: Jiaxin Wu , Siyuan Fu , Laszlo Ersek Subject: [PATCH v2] NetworkPkg/Ip6Dxe: Fix ASSERT logic in Ip6ProcessRouterAdvertise() Date: Thu, 2 Apr 2020 11:14:34 +0200 Message-Id: <20200402091434.1668-1-maciej.rabeda@linux.intel.com> X-Mailer: git-send-email 2.24.0.windows.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2655 This patch fixes reversed logic of recently added ASSERTs which should ensure that Ip6IsNDOptionValid() implementation properly reacts to invalid packets. Cc: Jiaxin Wu Cc: Siyuan Fu Signed-off-by: Maciej Rabeda Reviewed-by: Siyuan Fu Tested-by: Laszlo Ersek Fixes: 9c20342eed70ec99ec50cd73cb81804299f05403 --- NetworkPkg/Ip6Dxe/Ip6Nd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/NetworkPkg/Ip6Dxe/Ip6Nd.c b/NetworkPkg/Ip6Dxe/Ip6Nd.c index fd7f60b2f92c..0780a98cb325 100644 --- a/NetworkPkg/Ip6Dxe/Ip6Nd.c +++ b/NetworkPkg/Ip6Dxe/Ip6Nd.c @@ -2111,7 +2111,7 @@ Ip6ProcessRouterAdvertise ( // Option size validity ensured by Ip6IsNDOptionValid().=0D //=0D ASSERT (LinkLayerOption.Length !=3D 0);=0D - ASSERT (Offset + (UINT32) LinkLayerOption.Length * 8 >=3D (UINT32) H= ead->PayloadLength);=0D + ASSERT (Offset + (UINT32) LinkLayerOption.Length * 8 <=3D (UINT32) H= ead->PayloadLength);=0D =0D ZeroMem (&LinkLayerAddress, sizeof (EFI_MAC_ADDRESS));=0D CopyMem (&LinkLayerAddress, LinkLayerOption.EtherAddr, 6);=0D @@ -2164,7 +2164,7 @@ Ip6ProcessRouterAdvertise ( // Option size validity ensured by Ip6IsNDOptionValid().=0D //=0D ASSERT (PrefixOption.Length =3D=3D 4);=0D - ASSERT (Offset + (UINT32) PrefixOption.Length * 8 >=3D (UINT32) Head= ->PayloadLength);=0D + ASSERT (Offset + (UINT32) PrefixOption.Length * 8 <=3D (UINT32) Head= ->PayloadLength);=0D =0D PrefixOption.ValidLifetime =3D NTOHL (PrefixOption.ValidLifetime= );=0D PrefixOption.PreferredLifetime =3D NTOHL (PrefixOption.PreferredLife= time);=0D @@ -2334,7 +2334,7 @@ Ip6ProcessRouterAdvertise ( // Option size validity ensured by Ip6IsNDOptionValid().=0D //=0D ASSERT (MTUOption.Length =3D=3D 1);=0D - ASSERT (Offset + (UINT32) MTUOption.Length * 8 >=3D (UINT32) Head->P= ayloadLength);=0D + ASSERT (Offset + (UINT32) MTUOption.Length * 8 <=3D (UINT32) Head->P= ayloadLength);=0D =0D //=0D // Use IPv6 minimum link MTU 1280 bytes as the maximum packet size i= n order=0D --=20 2.24.0.windows.2