From 8b40f01a3f03c16897a01b827b7e3e8943274aac Mon Sep 17 00:00:00 2001
From: Jiaxin Wu <jiaxin.wu@intel.com>
Date: Fri, 22 Dec 2017 11:28:42 +0800
Subject: NetworkPkg/TcpDxe: Check FragmentBuffer for NULL before use

According the Spec, the FragmentBuffers in FragmentTable are allocated
by the application when calling Receive() function. This patch is to
check whether the FragmentBuffer is valid or not.

Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Wang Fan <fan.wang@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
---
 NetworkPkg/TcpDxe/TcpMain.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'NetworkPkg/TcpDxe')

diff --git a/NetworkPkg/TcpDxe/TcpMain.c b/NetworkPkg/TcpDxe/TcpMain.c
index fc3713e533..e349d2dce6 100644
--- a/NetworkPkg/TcpDxe/TcpMain.c
+++ b/NetworkPkg/TcpDxe/TcpMain.c
@@ -40,6 +40,9 @@ TcpChkDataBuf (
   UINT32 Len;
 
   for (Index = 0, Len = 0; Index < FragmentCount; Index++) {
+    if (FragmentTable[Index].FragmentBuffer == NULL) {
+      return EFI_INVALID_PARAMETER;
+    }
     Len = Len + FragmentTable[Index].FragmentLength;
   }
 
-- 
cgit v1.2.3