From 6510dcf6f71adbe282bff0ba2b236f1d074f819f Mon Sep 17 00:00:00 2001
From: "devel@edk2.groups.io" <devel@edk2.groups.io>
Date: Fri, 10 Feb 2023 04:34:03 -0800
Subject: NetworkPkg/HttpDxe: fix driver binding start issue.

When failure happens in HttpDxeStart, the error handling code
release the memory buffer but it does not uninstall HTTP service
binding protocol. As the result, application can still locate
this protocol and invoke service binding functions in released
memory pool.

Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Abner Chang <abner.chang@amd.com>
Cc: Igor Kulchytskyy <igork@ami.com>
Cc: Nick Ramirez <nramirez@nvidia.com>
Signed-off-by: Nickle Wang <nicklew@nvidia.com>
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 NetworkPkg/HttpDxe/HttpDriver.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/NetworkPkg/HttpDxe/HttpDriver.c b/NetworkPkg/HttpDxe/HttpDriver.c
index 5d918d3c4d..f6d1263cad 100644
--- a/NetworkPkg/HttpDxe/HttpDriver.c
+++ b/NetworkPkg/HttpDxe/HttpDriver.c
@@ -3,6 +3,7 @@
 
   Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
   (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
+  Copyright (c) 2023, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
   SPDX-License-Identifier: BSD-2-Clause-Patent
 
@@ -464,8 +465,16 @@ ON_ERROR:
 
   if (HttpService != NULL) {
     HttpCleanService (HttpService, UsingIpv6);
-    if ((HttpService->Tcp4ChildHandle == NULL) && (HttpService->Tcp6ChildHandle == NULL)) {
-      FreePool (HttpService);
+    Status = gBS->UninstallMultipleProtocolInterfaces (
+                    &ControllerHandle,
+                    &gEfiHttpServiceBindingProtocolGuid,
+                    &HttpService->ServiceBinding,
+                    NULL
+                    );
+    if (!EFI_ERROR (Status)) {
+      if ((HttpService->Tcp4ChildHandle == NULL) && (HttpService->Tcp6ChildHandle == NULL)) {
+        FreePool (HttpService);
+      }
     }
   }
 
-- 
cgit v1.2.3