summaryrefslogtreecommitdiffstats
path: root/NetworkPkg
diff options
context:
space:
mode:
authorJiaxin Wu <jiaxin.wu@intel.com>2016-12-23 11:13:21 +0800
committerJiaxin Wu <jiaxin.wu@intel.com>2016-12-26 16:56:14 +0800
commit63f1d6a4c0f5df43e7c77041087754ddd169dea8 (patch)
tree33a619731bc6117a18254a4b72f7c35a8bbcbc99 /NetworkPkg
parent0e5e7996c9366fd6f710963c6a414003fd5a95ec (diff)
downloadedk2-63f1d6a4c0f5df43e7c77041087754ddd169dea8.tar.gz
edk2-63f1d6a4c0f5df43e7c77041087754ddd169dea8.tar.bz2
edk2-63f1d6a4c0f5df43e7c77041087754ddd169dea8.zip
NetworkPkg/HttpDxe: Fix the potential NULL dereference
Cc: Ye Ting <ting.ye@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Wu Hao A <hao.a.wu@intel.com> Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Ye Ting <ting.ye@intel.com>
Diffstat (limited to 'NetworkPkg')
-rw-r--r--NetworkPkg/HttpDxe/HttpImpl.c4
-rw-r--r--NetworkPkg/HttpDxe/HttpProto.c6
-rw-r--r--NetworkPkg/HttpDxe/HttpsSupport.c74
3 files changed, 60 insertions, 24 deletions
diff --git a/NetworkPkg/HttpDxe/HttpImpl.c b/NetworkPkg/HttpDxe/HttpImpl.c
index 77aa64a2b9..d19f73348d 100644
--- a/NetworkPkg/HttpDxe/HttpImpl.c
+++ b/NetworkPkg/HttpDxe/HttpImpl.c
@@ -591,10 +591,12 @@ EfiHttpRequest (
Status = HttpGenRequestMessage (HttpMsg, FileUrl, &RequestMsg, &RequestMsgSize);
- if (EFI_ERROR (Status)) {
+ if (EFI_ERROR (Status) || NULL == RequestMsg) {
goto Error3;
}
+ ASSERT (RequestMsg != NULL);
+
//
// Every request we insert a TxToken and a response call would remove the TxToken.
// In cases of PUT/POST, after an initial request-response pair, we would do a
diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c
index 36c61e2e99..199d575cf9 100644
--- a/NetworkPkg/HttpDxe/HttpProto.c
+++ b/NetworkPkg/HttpDxe/HttpProto.c
@@ -1655,6 +1655,8 @@ HttpTcpTransmit (
UINTN UrlSize;
UINTN RequestMsgSize;
+ RequestMsg = NULL;
+
ValueInItem = (HTTP_TOKEN_WRAP *) Item->Value;
if (ValueInItem->TcpWrap.IsTxDone) {
return EFI_SUCCESS;
@@ -1682,10 +1684,12 @@ HttpTcpTransmit (
);
FreePool (Url);
- if (EFI_ERROR (Status)){
+ if (EFI_ERROR (Status) || NULL == RequestMsg){
return Status;
}
+ ASSERT (RequestMsg != NULL);
+
//
// Transmit the request message.
//
diff --git a/NetworkPkg/HttpDxe/HttpsSupport.c b/NetworkPkg/HttpDxe/HttpsSupport.c
index 478a9e0b7b..c9e6988968 100644
--- a/NetworkPkg/HttpDxe/HttpsSupport.c
+++ b/NetworkPkg/HttpDxe/HttpsSupport.c
@@ -401,33 +401,37 @@ TlsConfigCertificate (
NULL
);
- if (Status == EFI_BUFFER_TOO_SMALL) {
+ if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
+ return Status;
+ }
+
+ //
+ // Allocate buffer and read the config variable.
+ //
+ CACert = AllocatePool (CACertSize);
+ if (CACert == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+
+ Status = gRT->GetVariable (
+ EFI_TLS_CA_CERTIFICATE_VARIABLE,
+ &gEfiTlsCaCertificateGuid,
+ NULL,
+ &CACertSize,
+ CACert
+ );
+ if (EFI_ERROR (Status)) {
//
- // Allocate buffer and read the config variable.
+ // GetVariable still error or the variable is corrupted.
+ // Fall back to the default value.
//
- CACert = AllocatePool (CACertSize);
- if (CACert == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
-
- Status = gRT->GetVariable (
- EFI_TLS_CA_CERTIFICATE_VARIABLE,
- &gEfiTlsCaCertificateGuid,
- NULL,
- &CACertSize,
- CACert
- );
- if (EFI_ERROR (Status)) {
- //
- // GetVariable still error or the variable is corrupted.
- // Fall back to the default value.
- //
- FreePool (CACert);
+ FreePool (CACert);
- return EFI_NOT_FOUND;
- }
+ return EFI_NOT_FOUND;
}
+ ASSERT (CACert != NULL);
+
//
// Enumerate all data and erasing the target item.
//
@@ -1037,6 +1041,11 @@ TlsConnectSession (
//
PacketOut = NetbufAlloc ((UINT32) BufferOutSize);
DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL);
+ if (DataOut == NULL) {
+ FreePool (BufferOut);
+ return EFI_OUT_OF_RESOURCES;
+ }
+
CopyMem (DataOut, BufferOut, BufferOutSize);
Status = TlsCommonTransmit (HttpInstance, PacketOut);
@@ -1107,6 +1116,7 @@ TlsConnectSession (
FreePool (BufferIn);
if (EFI_ERROR (Status)) {
+ FreePool (BufferOut);
return Status;
}
@@ -1116,6 +1126,11 @@ TlsConnectSession (
//
PacketOut = NetbufAlloc ((UINT32) BufferOutSize);
DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL);
+ if (DataOut == NULL) {
+ FreePool (BufferOut);
+ return EFI_OUT_OF_RESOURCES;
+ }
+
CopyMem (DataOut, BufferOut, BufferOutSize);
Status = TlsCommonTransmit (HttpInstance, PacketOut);
@@ -1267,6 +1282,11 @@ TlsCloseSession (
PacketOut = NetbufAlloc ((UINT32) BufferOutSize);
DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL);
+ if (DataOut == NULL) {
+ FreePool (BufferOut);
+ return EFI_OUT_OF_RESOURCES;
+ }
+
CopyMem (DataOut, BufferOut, BufferOutSize);
Status = TlsCommonTransmit (HttpInstance, PacketOut);
@@ -1540,6 +1560,11 @@ HttpsReceive (
if (BufferOutSize != 0) {
PacketOut = NetbufAlloc ((UINT32)BufferOutSize);
DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL);
+ if (DataOut == NULL) {
+ FreePool (BufferOut);
+ return EFI_OUT_OF_RESOURCES;
+ }
+
CopyMem (DataOut, BufferOut, BufferOutSize);
Status = TlsCommonTransmit (HttpInstance, PacketOut);
@@ -1627,6 +1652,11 @@ HttpsReceive (
if (BufferOutSize != 0) {
PacketOut = NetbufAlloc ((UINT32) BufferOutSize);
DataOut = NetbufAllocSpace (PacketOut, (UINT32) BufferOutSize, NET_BUF_TAIL);
+ if (DataOut == NULL) {
+ FreePool (BufferOut);
+ return EFI_OUT_OF_RESOURCES;
+ }
+
CopyMem (DataOut, BufferOut, BufferOutSize);
Status = TlsCommonTransmit (HttpInstance, PacketOut);