diff options
Diffstat (limited to 'NetworkPkg/TcpDxe/TcpInput.c')
| -rw-r--r-- | NetworkPkg/TcpDxe/TcpInput.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/NetworkPkg/TcpDxe/TcpInput.c b/NetworkPkg/TcpDxe/TcpInput.c index d0118f1d88..745ee4cc6e 100644 --- a/NetworkPkg/TcpDxe/TcpInput.c +++ b/NetworkPkg/TcpDxe/TcpInput.c @@ -1,7 +1,7 @@ /** @file
TCP input process routines.
- Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2009 - 2016 Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
@@ -748,11 +748,18 @@ TcpInput ( Head = (TCP_HEAD *) NetbufGetByte (Nbuf, 0, NULL);
ASSERT (Head != NULL);
+
+ if (Nbuf->TotalSize < sizeof (TCP_HEAD)) {
+ DEBUG ((EFI_D_INFO, "TcpInput: received a malformed packet\n"));
+ goto DISCARD;
+ }
+
Len = Nbuf->TotalSize - (Head->HeadLen << 2);
if ((Head->HeadLen < 5) || (Len < 0)) {
DEBUG ((EFI_D_INFO, "TcpInput: received a malformed packet\n"));
+
goto DISCARD;
}
@@ -1560,6 +1567,10 @@ TcpIcmpInput ( BOOLEAN IcmpErrIsHard;
BOOLEAN IcmpErrNotify;
+ if (Nbuf->TotalSize < sizeof (TCP_HEAD)) {
+ goto CLEAN_EXIT;
+ }
+
Head = (TCP_HEAD *) NetbufGetByte (Nbuf, 0, NULL);
ASSERT (Head != NULL);
|