Sync part of patch r12514 from main trunk.UDK2010

Add pointer check for NULL before dereference it.


git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/branches/UDK2010@12953 6f19259b-4bc3-4df7-8a09-765794883524

4 files changed, 45 insertions, 25 deletions

diff --git a/MdeModulePkg/Library/UefiHiiLib/HiiLib.c b/MdeModulePkg/Library/UefiHiiLib/HiiLib.c
index d1ad994d70..637d30fe90 100644
--- a/MdeModulePkg/Library/UefiHiiLib/HiiLib.c
+++ b/MdeModulePkg/Library/UefiHiiLib/HiiLib.c
@@ -2505,9 +2505,7 @@ InternalHiiGrowOpCodeHandle (
               OpCodeBuffer->BufferSize + (Size + HII_LIB_OPCODE_ALLOCATION_SIZE),

               OpCodeBuffer->Buffer

               );

-    if (Buffer == NULL) {

-      return NULL;

-    }

+    ASSERT (Buffer != NULL);

     OpCodeBuffer->Buffer = Buffer;

     OpCodeBuffer->BufferSize += (Size + HII_LIB_OPCODE_ALLOCATION_SIZE);

   }

diff --git a/NetworkPkg/Ip6Dxe/Ip6Nd.c b/NetworkPkg/Ip6Dxe/Ip6Nd.c
index f2a47a8073..e0ec832228 100644
--- a/NetworkPkg/Ip6Dxe/Ip6Nd.c
+++ b/NetworkPkg/Ip6Dxe/Ip6Nd.c
@@ -1498,13 +1498,16 @@ Ip6ProcessNeighborSolicit (
     goto Exit;

   } else {

     OptionLen = (UINT16) (Head->PayloadLength - IP6_ND_LENGTH);

-    Option    = NetbufGetByte (Packet, IP6_ND_LENGTH, NULL);

+    if (OptionLen != 0) {

+      Option    = NetbufGetByte (Packet, IP6_ND_LENGTH, NULL);

+      ASSERT (Option != NULL);

 

-    //

-    // All included options should have a length that is greater than zero.

-    //

-    if (!Ip6IsNDOptionValid (Option, OptionLen)) {

-      goto Exit;

+      //

+      // All included options should have a length that is greater than zero.

+      //

+      if (!Ip6IsNDOptionValid (Option, OptionLen)) {

+        goto Exit;

+      }

     }

   }

 

@@ -1734,13 +1737,16 @@ Ip6ProcessNeighborAdvertise (
     goto Exit;

   } else {

     OptionLen = (UINT16) (Head->PayloadLength - IP6_ND_LENGTH);

-    Option    = NetbufGetByte (Packet, IP6_ND_LENGTH, NULL);

+    if (OptionLen != 0) {

+      Option    = NetbufGetByte (Packet, IP6_ND_LENGTH, NULL);

+      ASSERT (Option != NULL);

 

-    //

-    // All included options should have a length that is greater than zero.

-    //

-    if (!Ip6IsNDOptionValid (Option, OptionLen)) {

-      goto Exit;

+      //

+      // All included options should have a length that is greater than zero.

+      //

+      if (!Ip6IsNDOptionValid (Option, OptionLen)) {

+        goto Exit;

+      }

     }

   }

 

@@ -1983,10 +1989,13 @@ Ip6ProcessRouterAdvertise (
   // All included options have a length that is greater than zero.

   //

   OptionLen = (UINT16) (Head->PayloadLength - IP6_RA_LENGTH);

-  Option    = NetbufGetByte (Packet, IP6_RA_LENGTH, NULL);

+  if (OptionLen != 0) {

+    Option    = NetbufGetByte (Packet, IP6_RA_LENGTH, NULL);

+    ASSERT (Option != NULL);

 

-  if (!Ip6IsNDOptionValid (Option, OptionLen)) {

-    goto Exit;

+    if (!Ip6IsNDOptionValid (Option, OptionLen)) {

+      goto Exit;

+    }

   }

 

   //

@@ -2429,10 +2438,13 @@ Ip6ProcessRedirect (
   // All included options have a length that is greater than zero.

   //

   OptionLen = (UINT16) (Head->PayloadLength - IP6_REDITECT_LENGTH);

-  Option    = NetbufGetByte (Packet, IP6_REDITECT_LENGTH, NULL);

+  if (OptionLen != 0) {

+    Option    = NetbufGetByte (Packet, IP6_REDITECT_LENGTH, NULL);

+    ASSERT (Option != NULL);

 

-  if (!Ip6IsNDOptionValid (Option, OptionLen)) {

-    goto Exit;

+    if (!Ip6IsNDOptionValid (Option, OptionLen)) {

+      goto Exit;

+    }

   }

 

   Target   = (EFI_IPv6_ADDRESS *) (Icmp + 1);

diff --git a/NetworkPkg/IpSecDxe/IpSecConfigImpl.c b/NetworkPkg/IpSecDxe/IpSecConfigImpl.c
index e671e42e27..a976459692 100644
--- a/NetworkPkg/IpSecDxe/IpSecConfigImpl.c
+++ b/NetworkPkg/IpSecDxe/IpSecConfigImpl.c
@@ -1,7 +1,7 @@
 /** @file

   The implementation of IPSEC_CONFIG_PROTOCOL.

 

-  Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>

+  Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>

 

   This program and the accompanying materials

   are licensed and made available under the terms and conditions of the BSD License

@@ -1995,6 +1995,10 @@ IpSecGetVariable (
                         VariableNameISizeNew,

                         VariableNameI

                         );

+      if (VariableNameI == NULL) {

+        Status = EFI_OUT_OF_RESOURCES;

+        break;

+      }

       VariableNameISize = VariableNameISizeNew;

 

       Status = gRT->GetNextVariableName (

@@ -2071,7 +2075,9 @@ IpSecGetVariable (
   }

 

 ON_EXIT:

-  FreePool (VariableNameI);

+  if (VariableNameI != NULL) {

+    FreePool (VariableNameI);

+  }

   return Status;

 }

 

@@ -2498,8 +2504,8 @@ IpSecCopyPolicyEntry (
     //

     Buffer->Capacity += EntrySize;

     TempPoint         = AllocatePool (Buffer->Capacity);

-

-    if (Buffer->Ptr == NULL) {

+    

+    if (TempPoint == NULL) {

       return EFI_OUT_OF_RESOURCES;

     }

     //

diff --git a/ShellPkg/Library/UefiShellLib/UefiShellLib.c b/ShellPkg/Library/UefiShellLib/UefiShellLib.c
index d3cc59e9be..521bb8e64b 100644
--- a/ShellPkg/Library/UefiShellLib/UefiShellLib.c
+++ b/ShellPkg/Library/UefiShellLib/UefiShellLib.c
@@ -1784,6 +1784,10 @@ InternalCommandLineParse (
   // initialize the linked list

   //

   *CheckPackage = (LIST_ENTRY*)AllocateZeroPool(sizeof(LIST_ENTRY));

+  if (*CheckPackage == NULL) {

+    return (EFI_OUT_OF_RESOURCES);

+  }

+

   InitializeListHead(*CheckPackage);

 

   //