diff options
| author | Jiaxin Wu <jiaxin.wu@intel.com> | 2017-04-12 16:36:11 +0800 |
|---|---|---|
| committer | Jiaxin Wu <jiaxin.wu@intel.com> | 2017-04-21 13:03:29 +0800 |
| commit | 6893b16fb9f8afef71ae4e9e3dead6bb685f6994 (patch) | |
| tree | 082b07be52d916f0d5c7fb605e443ba93364efc6 /NetworkPkg/HttpDxe | |
| parent | d3d562b90419596a1c7dec75d1b49a89b968ead1 (diff) | |
| download | edk2-6893b16fb9f8afef71ae4e9e3dead6bb685f6994.tar.gz edk2-6893b16fb9f8afef71ae4e9e3dead6bb685f6994.tar.bz2 edk2-6893b16fb9f8afef71ae4e9e3dead6bb685f6994.zip | |
NetworkPkg/HttpDxe: Fix HTTP download OS image over 4G size failure
UINT32 integer overflow will happen once the download OS image over
4G size. This patch is to fix this issue.
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Zhang Lubo <lubo.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Sriram Subramanian <sriram-s@hpe.com>
Diffstat (limited to 'NetworkPkg/HttpDxe')
| -rw-r--r-- | NetworkPkg/HttpDxe/HttpProto.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c index 3d61ba2ae1..3fda294be3 100644 --- a/NetworkPkg/HttpDxe/HttpProto.c +++ b/NetworkPkg/HttpDxe/HttpProto.c @@ -2031,8 +2031,8 @@ HttpTcpReceiveBody ( if (HttpInstance->LocalAddressIsIPv6) {
Rx6Token = &Wrap->TcpWrap.Rx6Token;
- Rx6Token ->Packet.RxData->DataLength = (UINT32) HttpMsg->BodyLength;
- Rx6Token ->Packet.RxData->FragmentTable[0].FragmentLength = (UINT32) HttpMsg->BodyLength;
+ Rx6Token ->Packet.RxData->DataLength = (UINT32) MIN (MAX_UINT32, HttpMsg->BodyLength);
+ Rx6Token ->Packet.RxData->FragmentTable[0].FragmentLength = (UINT32) MIN (MAX_UINT32, HttpMsg->BodyLength);
Rx6Token ->Packet.RxData->FragmentTable[0].FragmentBuffer = (VOID *) HttpMsg->Body;
Rx6Token->CompletionToken.Status = EFI_NOT_READY;
@@ -2043,8 +2043,8 @@ HttpTcpReceiveBody ( }
} else {
Rx4Token = &Wrap->TcpWrap.Rx4Token;
- Rx4Token->Packet.RxData->DataLength = (UINT32) HttpMsg->BodyLength;
- Rx4Token->Packet.RxData->FragmentTable[0].FragmentLength = (UINT32) HttpMsg->BodyLength;
+ Rx4Token->Packet.RxData->DataLength = (UINT32) MIN (MAX_UINT32, HttpMsg->BodyLength);
+ Rx4Token->Packet.RxData->FragmentTable[0].FragmentLength = (UINT32) MIN (MAX_UINT32, HttpMsg->BodyLength);
Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = (VOID *) HttpMsg->Body;
Rx4Token->CompletionToken.Status = EFI_NOT_READY;
|