The function Dhcp6HandleStateful checks

 

  if (Instance->Config == NULL) {

    goto ON_CONTINUE;

  }

 

At label ON_CONTINUE, UdpIoRecvDatagram function is called and if for

whatever reasons its return value is not EFI_SUCCESS, then the check

if (EFI_ERROR (Status)) at label ON_EXIT passes leading to invokation

of Dhcp6CleanupSession function in which

 

  ASSERT (Instance->Config);

 

will get hit in DEBUG mode and in RELEASE mode, the code continues to

dereference Instance->Config in the check

 

  if (Instance->Config->IaInfoEvent != NULL) {

 

which will lead to CRASH as Instance->Config is NULL.

 

Hence, for safety add Instance->Config NULL pointer check before

calling Dhcp6CleanupSession.

 

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4223

Signed-off-by: Ranbir Singh <Ranbir.Singh3@Dell.com>

---

 NetworkPkg/Dhcp6Dxe/Dhcp6Io.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

 

diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c

index dcd01e6268..2c924d373f 100644

--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c

+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c

@@ -2636,7 +2636,7 @@ ON_CONTINUE:

              0

              );

 ON_EXIT:

-  if (EFI_ERROR (Status)) {

+  if (EFI_ERROR (Status) && (Instance->Config != NULL)) {

     Dhcp6CleanupSession (Instance, Status);

   }

 }

--

2.36.1.windows.1