summaryrefslogtreecommitdiffstats
path: root/NetworkPkg
diff options
context:
space:
mode:
authorLi, Songpeng <songpeng.li@intel.com>2018-09-28 11:02:35 +0800
committerFu Siyuan <siyuan.fu@intel.com>2018-09-29 10:51:37 +0800
commit130e62928449ba35375282e045aecb8cc29697ec (patch)
tree617b1d63127ec06e9a94f4c3b6733ebb8d870804 /NetworkPkg
parent2239ea71b65072ce3c76d56e7074d2ee60ba1762 (diff)
downloadedk2-130e62928449ba35375282e045aecb8cc29697ec.tar.gz
edk2-130e62928449ba35375282e045aecb8cc29697ec.tar.bz2
edk2-130e62928449ba35375282e045aecb8cc29697ec.zip
NetworkPkg/HttpUtilitiesDxe: fix read memory access overflow.
The input param String of AsciiStrStr() requires a pointer to Null-terminated string, however in HttpUtilitiesParse(), the Buffersize before AllocateZeroPool() is equal to the size of TCP header, after the CopyMem(), it might not end with Null-terminator. It might cause memory access overflow. Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Wu Jiaxin <jiaxin.wu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1204 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Songpeng Li <songpeng.li@intel.com> Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Diffstat (limited to 'NetworkPkg')
-rw-r--r--NetworkPkg/HttpUtilitiesDxe/HttpUtilitiesProtocol.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/NetworkPkg/HttpUtilitiesDxe/HttpUtilitiesProtocol.c b/NetworkPkg/HttpUtilitiesDxe/HttpUtilitiesProtocol.c
index a9a1c7c586..b0e3e7f081 100644
--- a/NetworkPkg/HttpUtilitiesDxe/HttpUtilitiesProtocol.c
+++ b/NetworkPkg/HttpUtilitiesDxe/HttpUtilitiesProtocol.c
@@ -298,6 +298,7 @@ HttpUtilitiesParse (
CHAR8 *FieldName;
CHAR8 *FieldValue;
UINTN Index;
+ UINTN HttpBufferSize;
Status = EFI_SUCCESS;
TempHttpMessage = NULL;
@@ -311,12 +312,17 @@ HttpUtilitiesParse (
return EFI_INVALID_PARAMETER;
}
- TempHttpMessage = AllocateZeroPool (HttpMessageSize);
+ //
+ // Append the http response string along with a Null-terminator.
+ //
+ HttpBufferSize = HttpMessageSize + 1;
+ TempHttpMessage = AllocatePool (HttpBufferSize);
if (TempHttpMessage == NULL) {
return EFI_OUT_OF_RESOURCES;
}
CopyMem (TempHttpMessage, HttpMessage, HttpMessageSize);
+ *(TempHttpMessage + HttpMessageSize) = '\0';
//
// Get header number