From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.100; helo=mga07.intel.com; envelope-from=siyuan.fu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 3EEF3222CB30D for ; Thu, 21 Dec 2017 23:13:42 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Dec 2017 23:18:31 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,439,1508828400"; d="scan'208";a="4875291" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by orsmga006.jf.intel.com with ESMTP; 21 Dec 2017 23:18:31 -0800 Received: from fmsmsx151.amr.corp.intel.com (10.18.125.4) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 21 Dec 2017 23:18:31 -0800 Received: from shsmsx151.ccr.corp.intel.com (10.239.6.50) by FMSMSX151.amr.corp.intel.com (10.18.125.4) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 21 Dec 2017 23:18:25 -0800 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.213]) by SHSMSX151.ccr.corp.intel.com ([169.254.3.218]) with mapi id 14.03.0319.002; Fri, 22 Dec 2017 15:18:23 +0800 From: "Fu, Siyuan" To: "Wu, Jiaxin" , "edk2-devel@lists.01.org" CC: "Wang, Fan" , "Ye, Ting" Thread-Topic: [Patch 1/3] NetworkPkg/TcpDxe: Check FragmentBuffer for NULL before use Thread-Index: AQHTevOPjJBEeRrPKk+BdGFpTNMbhKNO9Cew Date: Fri, 22 Dec 2017 07:18:22 +0000 Message-ID: References: <1513926438-4160-1-git-send-email-jiaxin.wu@intel.com> <1513926438-4160-2-git-send-email-jiaxin.wu@intel.com> In-Reply-To: <1513926438-4160-2-git-send-email-jiaxin.wu@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ctpclassification: CTP_IC x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZTVlOTJlMGMtZTMyNi00OGQ4LTg0N2UtZDVhMzkzNTIxZDk4IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjIuNS4xOCIsIlRydXN0ZWRMYWJlbEhhc2giOiI0cHZRVHlSSzM3Qnc4cGxtUGhqVm9NTTlIWDVvTWFyNGFqekdZN2RGZUNET094RVZuV0lZVmptdHBwT21nSGVTIn0= dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [Patch 1/3] NetworkPkg/TcpDxe: Check FragmentBuffer for NULL before use X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Dec 2017 07:13:42 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Fu Siyuan > -----Original Message----- > From: Wu, Jiaxin > Sent: Friday, December 22, 2017 3:07 PM > To: edk2-devel@lists.01.org > Cc: Fu, Siyuan ; Wang, Fan ; Ye, > Ting ; Wu, Jiaxin > Subject: [Patch 1/3] NetworkPkg/TcpDxe: Check FragmentBuffer for NULL > before use >=20 > According the Spec, the FragmentBuffers in FragmentTable are allocated > by the application when calling Receive() function. This patch is to > check whether the FragmentBuffer is valid or not. >=20 > Cc: Fu Siyuan > Cc: Wang Fan > Cc: Ye Ting > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Wu Jiaxin > --- > NetworkPkg/TcpDxe/TcpMain.c | 3 +++ > 1 file changed, 3 insertions(+) >=20 > diff --git a/NetworkPkg/TcpDxe/TcpMain.c b/NetworkPkg/TcpDxe/TcpMain.c > index fc3713e..e349d2d 100644 > --- a/NetworkPkg/TcpDxe/TcpMain.c > +++ b/NetworkPkg/TcpDxe/TcpMain.c > @@ -38,10 +38,13 @@ TcpChkDataBuf ( > UINT32 Index; >=20 > UINT32 Len; >=20 > for (Index =3D 0, Len =3D 0; Index < FragmentCount; Index++) { > + if (FragmentTable[Index].FragmentBuffer =3D=3D NULL) { > + return EFI_INVALID_PARAMETER; > + } > Len =3D Len + FragmentTable[Index].FragmentLength; > } >=20 > if (DataLen !=3D Len) { > return EFI_INVALID_PARAMETER; > -- > 1.9.5.msysgit.1