public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH 1/1] NetworkPkg: Fix possible infinite loop in HTTP msg body parser
@ 2020-08-28 18:17 Vladimir Olovyannikov
  2020-09-24 21:57 ` Vladimir Olovyannikov
  0 siblings, 1 reply; 8+ messages in thread
From: Vladimir Olovyannikov @ 2020-08-28 18:17 UTC (permalink / raw)
  To: devel; +Cc: Vladimir Olovyannikov, Maciej Rabeda, Jiaxin Wu, Siyuan Fu

When an HTTP server sends a non-chunked body data with no
Content-Length header, the HttpParserMessageBody in DxeHttpLib
gets confused and never sets the Char pointer beyond the body start.
This causes "for" loop to never break because the condition of
"Char >= Body + BodyLength" is never satisfied.
Use BodyLength as the ContentLength for the parser when
ContentLength is absent in HTTP response headers.
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2941

Signed-off-by: Vladimir Olovyannikov <vladimir.olovyannikov@broadcom.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
---
 NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c b/NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c
index 180d9321025a..e550c9962dc1 100644
--- a/NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c
+++ b/NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c
@@ -1122,6 +1122,7 @@ HttpParseMessageBody (
   CHAR8                 *Char;
   UINTN                 RemainderLengthInThis;
   UINTN                 LengthForCallback;
+  UINTN                 PortionLength;
   EFI_STATUS            Status;
   HTTP_BODY_PARSER      *Parser;
 
@@ -1173,19 +1174,31 @@ HttpParseMessageBody (
       //
       // Identity transfer-coding, just notify user to save the body data.
       //
+      PortionLength = MIN (
+                        BodyLength,
+                        Parser->ContentLength - Parser->ParsedBodyLength
+                        );
+      if (!PortionLength) {
+        //
+        // Got BodyLength, but no ContentLength. Use BodyLength.
+        //
+        PortionLength = BodyLength;
+        Parser->ContentLength = PortionLength;
+      }
+
       if (Parser->Callback != NULL) {
         Status = Parser->Callback (
                            BodyParseEventOnData,
                            Char,
-                           MIN (BodyLength, Parser->ContentLength - Parser->ParsedBodyLength),
+                           PortionLength,
                            Parser->Context
                            );
         if (EFI_ERROR (Status)) {
           return Status;
         }
       }
-      Char += MIN (BodyLength, Parser->ContentLength - Parser->ParsedBodyLength);
-      Parser->ParsedBodyLength += MIN (BodyLength, Parser->ContentLength - Parser->ParsedBodyLength);
+      Char += PortionLength;
+      Parser->ParsedBodyLength += PortionLength;
       if (Parser->ParsedBodyLength == Parser->ContentLength) {
         Parser->State = BodyParserComplete;
         if (Parser->Callback != NULL) {
-- 
2.26.2.266.ge870325ee8


^ permalink raw reply related	[flat|nested] 8+ messages in thread
* [PATCH v9 0/1] ShellPkg/DynamicCommand: add HttpDynamicCommand
@ 2020-08-30  0:28 Vladimir Olovyannikov
  2020-08-30  0:28 ` [PATCH 1/1] NetworkPkg: Fix possible infinite loop in HTTP msg body parser Vladimir Olovyannikov
  0 siblings, 1 reply; 8+ messages in thread
From: Vladimir Olovyannikov @ 2020-08-30  0:28 UTC (permalink / raw)
  To: devel
  Cc: Vladimir Olovyannikov, Zhichao Gao, Maciej Rabeda, Jiaxin Wu,
	Siyuan Fu, Ray Ni, Liming Gao, Nd, Laszlo Ersek,
	Samer El-Haj-Mahmoud

Signed-off-by: Vladimir Olovyannikov <vladimir.olovyannikov@broadcom.com>
Cc: Zhichao Gao <zhichao.gao@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Nd <nd@arm.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Samer El-Haj-Mahmoud <Samer.El-Haj-Mahmoud@arm.com>

This patchset introduces an http client utilizing EDK2 HTTP protocol, to
allow fast image downloading from http/https servers.
HTTP download speed is usually faster than tftp.
The client is based on the same approach as tftp dynamic command, and
uses the same UEFI Shell command line parameters. This makes it easy
integrating http into existing UEFI Shell scripts.
Note that to enable HTTP download, feature Pcd
gEfiNetworkPkgTokenSpaceGuid.PcdAllowHttpConnections must be set to TRUE.

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2860

PATCH v9 changes:
  - check that Response pointer is not NULL before accessing Data structure 
    member, to prevent possible NULL pointer dereference.


Vladimir Olovyannikov (1):
  ShellPkg/DynamicCommand: add HttpDynamicCommand

 ShellPkg/ShellPkg.dec                         |    1 +
 ShellPkg/ShellPkg.dsc                         |    5 +
 .../HttpDynamicCommand/HttpApp.inf            |   58 +
 .../HttpDynamicCommand/HttpDynamicCommand.inf |   63 +
 .../DynamicCommand/HttpDynamicCommand/Http.h  |   90 +
 ShellPkg/Include/Guid/ShellLibHiiGuid.h       |    5 +
 .../DynamicCommand/HttpDynamicCommand/Http.c  | 1830 +++++++++++++++++
 .../HttpDynamicCommand/HttpApp.c              |   61 +
 .../HttpDynamicCommand/HttpDynamicCommand.c   |  137 ++
 .../HttpDynamicCommand/Http.uni               |  117 ++
 10 files changed, 2367 insertions(+)
 create mode 100644 ShellPkg/DynamicCommand/HttpDynamicCommand/HttpApp.inf
 create mode 100644 ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 create mode 100644 ShellPkg/DynamicCommand/HttpDynamicCommand/Http.h
 create mode 100644 ShellPkg/DynamicCommand/HttpDynamicCommand/Http.c
 create mode 100644 ShellPkg/DynamicCommand/HttpDynamicCommand/HttpApp.c
 create mode 100644 ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.c
 create mode 100644 ShellPkg/DynamicCommand/HttpDynamicCommand/Http.uni

-- 
2.26.2.266.ge870325ee8


^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-10-09 11:02 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-08-28 18:17 [PATCH 1/1] NetworkPkg: Fix possible infinite loop in HTTP msg body parser Vladimir Olovyannikov
2020-09-24 21:57 ` Vladimir Olovyannikov
2020-09-30  9:56   ` [edk2-devel] " Maciej Rabeda
2020-10-01 15:25     ` Vladimir Olovyannikov
2020-10-02 12:02       ` Maciej Rabeda
2020-10-02 15:08         ` Vladimir Olovyannikov
2020-10-09 11:02           ` Maciej Rabeda
  -- strict thread matches above, loose matches on Subject: below --
2020-08-30  0:28 [PATCH v9 0/1] ShellPkg/DynamicCommand: add HttpDynamicCommand Vladimir Olovyannikov
2020-08-30  0:28 ` [PATCH 1/1] NetworkPkg: Fix possible infinite loop in HTTP msg body parser Vladimir Olovyannikov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox