From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 854AA21ECCB18 for ; Wed, 20 Sep 2017 01:13:48 -0700 (PDT) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Sep 2017 01:16:53 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.42,420,1500966000"; d="scan'208";a="137414948" Received: from fmsmsx107.amr.corp.intel.com ([10.18.124.205]) by orsmga002.jf.intel.com with ESMTP; 20 Sep 2017 01:16:52 -0700 Received: from fmsmsx114.amr.corp.intel.com (10.18.116.8) by fmsmsx107.amr.corp.intel.com (10.18.124.205) with Microsoft SMTP Server (TLS) id 14.3.319.2; Wed, 20 Sep 2017 01:16:53 -0700 Received: from shsmsx102.ccr.corp.intel.com (10.239.4.154) by FMSMSX114.amr.corp.intel.com (10.18.116.8) with Microsoft SMTP Server (TLS) id 14.3.319.2; Wed, 20 Sep 2017 01:16:52 -0700 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.213]) by shsmsx102.ccr.corp.intel.com ([169.254.2.175]) with mapi id 14.03.0319.002; Wed, 20 Sep 2017 16:16:50 +0800 From: "Wu, Jiaxin" To: "Fu, Siyuan" , "edk2-devel@lists.01.org" CC: "Ye, Ting" , Michael Turner Thread-Topic: [Patch] MdeModulePkg/DxeNetLib: Check the actual packet size before trim data from Nbuf. Thread-Index: AQHTMb/0gB4Rz1v8J0SRGmTlTz+XYKK9bU7w Date: Wed, 20 Sep 2017 08:16:50 +0000 Message-ID: <895558F6EA4E3B41AC93A00D163B727416335C65@SHSMSX103.ccr.corp.intel.com> References: <20170920032357.5864-1-siyuan.fu@intel.com> In-Reply-To: <20170920032357.5864-1-siyuan.fu@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNWRiZjQzNjgtZDJkMi00YjNkLWFlN2YtMDgzZmQ4MGVhZTljIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE2LjUuOS4zIiwiVHJ1c3RlZExhYmVsSGFzaCI6IlNCRCtRRFZ1bTFYTmJjcVZiR1lqRXRZSzhOZmM2RjZuR243MnA2ZGxHcFU9In0= x-ctpclassification: CTP_IC dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [Patch] MdeModulePkg/DxeNetLib: Check the actual packet size before trim data from Nbuf. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Sep 2017 08:13:48 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Siyuan, Maybe we can add more check for the Len to return directly, what do you thi= nk? if (Len =3D=3D 0) { return 0; } > + if (Nbuf->TotalSize =3D=3D 0) { > + return 0; > + } Thanks, Jiaxin > -----Original Message----- > From: Fu, Siyuan > Sent: Wednesday, September 20, 2017 11:24 AM > To: edk2-devel@lists.01.org > Cc: Wu, Jiaxin ; Ye, Ting ; Micha= el > Turner > Subject: [Patch] MdeModulePkg/DxeNetLib: Check the actual packet size > before trim data from Nbuf. >=20 > In NetbufTrim() function, the NetBuf TotalSize should be checked with 0 > before > making the trim operation, otherwise the function will fall into infinite= loop. >=20 > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Fu Siyuan > Cc: Wu Jiaxin > Cc: Ye Ting > Cc: Michael Turner > --- > MdeModulePkg/Library/DxeNetLib/NetBuffer.c | 4 ++++ > 1 file changed, 4 insertions(+) >=20 > diff --git a/MdeModulePkg/Library/DxeNetLib/NetBuffer.c > b/MdeModulePkg/Library/DxeNetLib/NetBuffer.c > index 95cb71714b..25fc78e49e 100644 > --- a/MdeModulePkg/Library/DxeNetLib/NetBuffer.c > +++ b/MdeModulePkg/Library/DxeNetLib/NetBuffer.c > @@ -1175,6 +1175,10 @@ NetbufTrim ( >=20 > NET_CHECK_SIGNATURE (Nbuf, NET_BUF_SIGNATURE); >=20 > + if (Nbuf->TotalSize =3D=3D 0) { > + return 0; > + } > + > if (Len > Nbuf->TotalSize) { > Len =3D Nbuf->TotalSize; > } > -- > 2.13.0.windows.1