tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Patch 

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534

Bug Details:
PixieFail Bug #1
CVE-2023-45229
CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-125 Out-of-bounds Read

Change Overview:

Introduce Dhcp6SeekInnerOptionSafe which performs checks before seeking
the Inner Option from a DHCP6 Option.

>
> EFI_STATUS
> Dhcp6SeekInnerOptionSafe (
>  IN  UINT16  IaType,
>  IN  UINT8   *Option,
>  IN  UINT32  OptionLen,
>  OUT UINT8   **IaInnerOpt,
>  OUT UINT16  *IaInnerLen
>  );
>

Lots of code cleanup to improve code readability.

Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>

Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
This commit is contained in:
Doug Flick via groups.io 2024-01-26 05:54:46 +08:00 committed by mergify[bot]
parent 5f3658197b
commit 1dbb10cc52
2 changed files with 256 additions and 85 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

138
NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h
View File

@ -45,6 +45,20 @@ typedef struct _DHCP6_INSTANCE DHCP6_INSTANCE;
#define DHCP6_SERVICE_SIGNATURE SIGNATURE_32 ('D', 'H', '6', 'S') #define DHCP6_SERVICE_SIGNATURE SIGNATURE_32 ('D', 'H', '6', 'S')
#define DHCP6_INSTANCE_SIGNATURE SIGNATURE_32 ('D', 'H', '6', 'I') #define DHCP6_INSTANCE_SIGNATURE SIGNATURE_32 ('D', 'H', '6', 'I')
#define DHCP6_PACKET_ALL 0
#define DHCP6_PACKET_STATEFUL 1
#define DHCP6_PACKET_STATELESS 2
#define DHCP6_BASE_PACKET_SIZE 1024
#define DHCP6_PORT_CLIENT 546
#define DHCP6_PORT_SERVER 547
#define DHCP_CHECK_MEDIA_WAITING_TIME EFI_TIMER_PERIOD_SECONDS(20)
#define DHCP6_INSTANCE_FROM_THIS(Instance) CR ((Instance), DHCP6_INSTANCE, Dhcp6, DHCP6_INSTANCE_SIGNATURE)
#define DHCP6_SERVICE_FROM_THIS(Service) CR ((Service), DHCP6_SERVICE, ServiceBinding, DHCP6_SERVICE_SIGNATURE)
// //
// For more information on DHCP options see RFC 8415, Section 21.1 // For more information on DHCP options see RFC 8415, Section 21.1
// //
@ -59,12 +73,10 @@ typedef struct _DHCP6_INSTANCE DHCP6_INSTANCE;
// | (option-len octets) | // | (option-len octets) |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// //
#define DHCP6_SIZE_OF_OPT_CODE (sizeof(UINT16)) #define DHCP6_SIZE_OF_OPT_CODE (sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpCode))
#define DHCP6_SIZE_OF_OPT_LEN (sizeof(UINT16)) #define DHCP6_SIZE_OF_OPT_LEN (sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpLen))
//
// Combined size of Code and Length // Combined size of Code and Length
//
#define DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN (DHCP6_SIZE_OF_OPT_CODE + \ #define DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN (DHCP6_SIZE_OF_OPT_CODE + \
DHCP6_SIZE_OF_OPT_LEN) DHCP6_SIZE_OF_OPT_LEN)
@ -73,34 +85,122 @@ STATIC_ASSERT (
"Combined size of Code and Length must be 4 per RFC 8415" "Combined size of Code and Length must be 4 per RFC 8415"
); );
//
// Offset to the length is just past the code // Offset to the length is just past the code
// #define DHCP6_OFFSET_OF_OPT_LEN(a) (a + DHCP6_SIZE_OF_OPT_CODE)
#define DHCP6_OPT_LEN_OFFSET(a) (a + DHCP6_SIZE_OF_OPT_CODE)
STATIC_ASSERT ( STATIC_ASSERT (
DHCP6_OPT_LEN_OFFSET (0) == 2, DHCP6_OFFSET_OF_OPT_LEN (0) == 2,
"Offset of length is + 2 past start of option" "Offset of length is + 2 past start of option"
); );
#define DHCP6_OPT_DATA_OFFSET(a) (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN) #define DHCP6_OFFSET_OF_OPT_DATA(a) (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN)
STATIC_ASSERT ( STATIC_ASSERT (
DHCP6_OPT_DATA_OFFSET (0) == 4, DHCP6_OFFSET_OF_OPT_DATA (0) == 4,
"Offset to option data should be +4 from start of option" "Offset to option data should be +4 from start of option"
); );
//
// Identity Association options (both NA (Non-Temporary) and TA (Temporary Association))
// are defined in RFC 8415 and are a deriviation of a TLV stucture
// For more information on IA_NA see Section 21.4
// For more information on IA_TA see Section 21.5
//
//
// The format of IA_NA and IA_TA option:
//
// 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | OPTION_IA_NA | option-len |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | IAID (4 octets) |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | T1 (only for IA_NA) |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | T2 (only for IA_NA) |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | |
// . IA_NA-options/IA_TA-options .
// . .
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
//
#define DHCP6_SIZE_OF_IAID (sizeof(UINT32))
#define DHCP6_SIZE_OF_TIME_INTERVAL (sizeof(UINT32))
#define DHCP6_PACKET_ALL 0 // Combined size of IAID, T1, and T2
#define DHCP6_PACKET_STATEFUL 1 #define DHCP6_SIZE_OF_COMBINED_IAID_T1_T2 (DHCP6_SIZE_OF_IAID + \
#define DHCP6_PACKET_STATELESS 2 DHCP6_SIZE_OF_TIME_INTERVAL + \
DHCP6_SIZE_OF_TIME_INTERVAL)
STATIC_ASSERT (
DHCP6_SIZE_OF_COMBINED_IAID_T1_T2 == 12,
"Combined size of IAID, T1, T2 must be 12 per RFC 8415"
);
#define DHCP6_BASE_PACKET_SIZE 1024 // This is the size of IA_TA without options
#define DHCP6_MIN_SIZE_OF_IA_TA (DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
DHCP6_SIZE_OF_IAID)
STATIC_ASSERT (
DHCP6_MIN_SIZE_OF_IA_TA == 8,
"Minimum combined size of IA_TA per RFC 8415"
);
#define DHCP6_PORT_CLIENT 546 // Offset to a IA_TA inner option
#define DHCP6_PORT_SERVER 547 #define DHCP6_OFFSET_OF_IA_TA_INNER_OPT(a) (a + DHCP6_MIN_SIZE_OF_IA_TA)
STATIC_ASSERT (
DHCP6_OFFSET_OF_IA_TA_INNER_OPT (0) == 8,
"Offset of IA_TA Inner option is + 8 past start of option"
);
#define DHCP_CHECK_MEDIA_WAITING_TIME EFI_TIMER_PERIOD_SECONDS(20) // This is the size of IA_NA without options (16)
#define DHCP6_MIN_SIZE_OF_IA_NA DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
DHCP6_SIZE_OF_COMBINED_IAID_T1_T2
STATIC_ASSERT (
DHCP6_MIN_SIZE_OF_IA_NA == 16,
"Minimum combined size of IA_TA per RFC 8415"
);
#define DHCP6_INSTANCE_FROM_THIS(Instance) CR ((Instance), DHCP6_INSTANCE, Dhcp6, DHCP6_INSTANCE_SIGNATURE) #define DHCP6_OFFSET_OF_IA_NA_INNER_OPT(a) (a + DHCP6_MIN_SIZE_OF_IA_NA)
#define DHCP6_SERVICE_FROM_THIS(Service) CR ((Service), DHCP6_SERVICE, ServiceBinding, DHCP6_SERVICE_SIGNATURE) STATIC_ASSERT (
DHCP6_OFFSET_OF_IA_NA_INNER_OPT (0) == 16,
"Offset of IA_NA Inner option is + 16 past start of option"
);
#define DHCP6_OFFSET_OF_IA_NA_T1(a) (a + \
DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
DHCP6_SIZE_OF_IAID)
STATIC_ASSERT (
DHCP6_OFFSET_OF_IA_NA_T1 (0) == 8,
"Offset of IA_NA Inner option is + 8 past start of option"
);
#define DHCP6_OFFSET_OF_IA_NA_T2(a) (a + \
DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN +\
DHCP6_SIZE_OF_IAID + \
DHCP6_SIZE_OF_TIME_INTERVAL)
STATIC_ASSERT (
DHCP6_OFFSET_OF_IA_NA_T2 (0) == 12,
"Offset of IA_NA Inner option is + 12 past start of option"
);
//
// For more information see RFC 8415 Section 21.13
//
// The format of the Status Code Option:
//
// 0 1 2 3
// 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | OPTION_STATUS_CODE | option-len |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | status-code | |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
// . .
// . status-message .
// . .
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
//
#define DHCP6_OFFSET_OF_STATUS_CODE(a) (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN)
STATIC_ASSERT (
DHCP6_OFFSET_OF_STATUS_CODE (0) == 4,
"Offset of status is + 4 past start of option"
);
extern EFI_IPv6_ADDRESS mAllDhcpRelayAndServersAddress; extern EFI_IPv6_ADDRESS mAllDhcpRelayAndServersAddress;
extern EFI_DHCP6_PROTOCOL gDhcp6ProtocolTemplate; extern EFI_DHCP6_PROTOCOL gDhcp6ProtocolTemplate;

199
NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
View File

@ -598,8 +598,8 @@ Dhcp6UpdateIaInfo (
// The inner options still start with 2 bytes option-code and 2 bytes option-len. // The inner options still start with 2 bytes option-code and 2 bytes option-len.
// //
if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) { if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) {
T1 = NTOHL (ReadUnaligned32 ((UINT32 *)(Option + 8))); T1 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T1 (Option))));
T2 = NTOHL (ReadUnaligned32 ((UINT32 *)(Option + 12))); T2 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T2 (Option))));
// //
// Refer to RFC3155 Chapter 22.4. If a client receives an IA_NA with T1 greater than T2, // Refer to RFC3155 Chapter 22.4. If a client receives an IA_NA with T1 greater than T2,
// and both T1 and T2 are greater than 0, the client discards the IA_NA option and processes // and both T1 and T2 are greater than 0, the client discards the IA_NA option and processes
@ -609,13 +609,14 @@ Dhcp6UpdateIaInfo (
return EFI_DEVICE_ERROR; return EFI_DEVICE_ERROR;
} }
IaInnerOpt = Option + 16; IaInnerOpt = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(Option + 2))) - 12); IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_COMBINED_IAID_T1_T2);
} else { } else {
T1 = 0; T1 = 0;
T2 = 0; T2 = 0;
IaInnerOpt = Option + 8;
IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(Option + 2))) - 4); IaInnerOpt = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_IAID);
} }
// //
@ -641,7 +642,7 @@ Dhcp6UpdateIaInfo (
Option = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode); Option = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode);
if (Option != NULL) { if (Option != NULL) {
StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(Option + 4))); StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
if (StsCode != Dhcp6StsSuccess) { if (StsCode != Dhcp6StsSuccess) {
return EFI_DEVICE_ERROR; return EFI_DEVICE_ERROR;
} }
@ -661,6 +662,87 @@ Dhcp6UpdateIaInfo (
return Status; return Status;
} }
/**
Seeks the Inner Options from a DHCP6 Option
@param[in] IaType The type of the IA option.
@param[in] Option The pointer to the DHCP6 Option.
@param[in] OptionLen The length of the DHCP6 Option.
@param[out] IaInnerOpt The pointer to the IA inner option.
@param[out] IaInnerLen The length of the IA inner option.
@retval EFI_SUCCESS Seek the inner option successfully.
@retval EFI_DEVICE_ERROR The OptionLen is invalid. On Error,
the pointers are not modified
**/
EFI_STATUS
Dhcp6SeekInnerOptionSafe (
IN UINT16 IaType,
IN UINT8 *Option,
IN UINT32 OptionLen,
OUT UINT8 **IaInnerOpt,
OUT UINT16 *IaInnerLen
)
{
UINT16 IaInnerLenTmp;
UINT8 *IaInnerOptTmp;
if (Option == NULL) {
ASSERT (Option != NULL);
return EFI_DEVICE_ERROR;
}
if (IaInnerOpt == NULL) {
ASSERT (IaInnerOpt != NULL);
return EFI_DEVICE_ERROR;
}
if (IaInnerLen == NULL) {
ASSERT (IaInnerLen != NULL);
return EFI_DEVICE_ERROR;
}
if (IaType == Dhcp6OptIana) {
// Verify we have a fully formed IA_NA
if (OptionLen < DHCP6_MIN_SIZE_OF_IA_NA) {
return EFI_DEVICE_ERROR;
}
//
IaInnerOptTmp = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
// Verify the IaInnerLen is valid.
IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)DHCP6_OFFSET_OF_OPT_LEN (Option)));
if (IaInnerLenTmp < DHCP6_SIZE_OF_COMBINED_IAID_T1_T2) {
return EFI_DEVICE_ERROR;
}
IaInnerLenTmp -= DHCP6_SIZE_OF_COMBINED_IAID_T1_T2;
} else if (IaType == Dhcp6OptIata) {
// Verify the OptionLen is valid.
if (OptionLen < DHCP6_MIN_SIZE_OF_IA_TA) {
return EFI_DEVICE_ERROR;
}
IaInnerOptTmp = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
// Verify the IaInnerLen is valid.
IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
if (IaInnerLenTmp < DHCP6_SIZE_OF_IAID) {
return EFI_DEVICE_ERROR;
}
IaInnerLenTmp -= DHCP6_SIZE_OF_IAID;
} else {
return EFI_DEVICE_ERROR;
}
*IaInnerOpt = IaInnerOptTmp;
*IaInnerLen = IaInnerLenTmp;
return EFI_SUCCESS;
}
/** /**
Seek StatusCode Option in package. A Status Code option may appear in the Seek StatusCode Option in package. A Status Code option may appear in the
options field of a DHCP message and/or in the options field of another option. options field of a DHCP message and/or in the options field of another option.
@ -684,6 +766,12 @@ Dhcp6SeekStsOption (
UINT8 *IaInnerOpt; UINT8 *IaInnerOpt;
UINT16 IaInnerLen; UINT16 IaInnerLen;
UINT16 StsCode; UINT16 StsCode;
UINT32 OptionLen;
// OptionLen is the length of the Options excluding the DHCP header.
// Length of the EFI_DHCP6_PACKET from the first byte of the Header field to the last
// byte of the Option[] field.
OptionLen = Packet->Length - sizeof (Packet->Dhcp6.Header);
// //
// Seek StatusCode option directly in DHCP message body. That is, search in // Seek StatusCode option directly in DHCP message body. That is, search in
@ -691,12 +779,12 @@ Dhcp6SeekStsOption (
// //
*Option = Dhcp6SeekOption ( *Option = Dhcp6SeekOption (
Packet->Dhcp6.Option, Packet->Dhcp6.Option,
Packet->Length - 4, OptionLen,
Dhcp6OptStatusCode Dhcp6OptStatusCode
); );
if (*Option != NULL) { if (*Option != NULL) {
StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(*Option + 4))); StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_STATUS_CODE (*Option))));
if (StsCode != Dhcp6StsSuccess) { if (StsCode != Dhcp6StsSuccess) {
return EFI_DEVICE_ERROR; return EFI_DEVICE_ERROR;
} }
@ -707,7 +795,7 @@ Dhcp6SeekStsOption (
// //
*Option = Dhcp6SeekIaOption ( *Option = Dhcp6SeekIaOption (
Packet->Dhcp6.Option, Packet->Dhcp6.Option,
Packet->Length - sizeof (EFI_DHCP6_HEADER), OptionLen,
&Instance->Config->IaDescriptor &Instance->Config->IaDescriptor
); );
if (*Option == NULL) { if (*Option == NULL) {
@ -715,52 +803,35 @@ Dhcp6SeekStsOption (
} }
// //
// The format of the IA_NA option is: // Calculate the distance from Packet->Dhcp6.Option to the IA option.
// //
// 0 1 2 3 // Packet->Size and Packet->Length are both UINT32 type, and Packet->Size is
// 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 // the size of the whole packet, including the DHCP header, and Packet->Length
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ // is the length of the DHCP message body, excluding the DHCP header.
// | OPTION_IA_NA | option-len |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | IAID (4 octets) |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | T1 |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | T2 |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | |
// . IA_NA-options .
// . .
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// //
// The format of the IA_TA option is: // (*Option - Packet->Dhcp6.Option) is the number of bytes from the start of
// DHCP6 option area to the start of the IA option.
// //
// 0 1 2 3 // Dhcp6SeekInnerOptionSafe() is searching starting from the start of the
// 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 // IA option to the end of the DHCP6 option area, thus subtract the space
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ // up until this option
// | OPTION_IA_TA | option-len |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | IAID (4 octets) |
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// | |
// . IA_TA-options .
// . .
// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
// //
OptionLen = OptionLen - (*Option - Packet->Dhcp6.Option);
// //
// sizeof (option-code + option-len + IaId) = 8 // Seek the inner option
// sizeof (option-code + option-len + IaId + T1) = 12
// sizeof (option-code + option-len + IaId + T1 + T2) = 16
// //
// The inner options still start with 2 bytes option-code and 2 bytes option-len. if (EFI_ERROR (
// Dhcp6SeekInnerOptionSafe (
if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) { Instance->Config->IaDescriptor.Type,
IaInnerOpt = *Option + 16; *Option,
IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(*Option + 2))) - 12); OptionLen,
} else { &IaInnerOpt,
IaInnerOpt = *Option + 8; &IaInnerLen
IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(*Option + 2))) - 4); )
))
{
return EFI_DEVICE_ERROR;
} }
// //
@ -784,7 +855,7 @@ Dhcp6SeekStsOption (
// //
*Option = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode); *Option = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode);
if (*Option != NULL) { if (*Option != NULL) {
StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(*Option + 4))); StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)((DHCP6_OFFSET_OF_STATUS_CODE (*Option)))));
if (StsCode != Dhcp6StsSuccess) { if (StsCode != Dhcp6StsSuccess) {
return EFI_DEVICE_ERROR; return EFI_DEVICE_ERROR;
} }
@ -1105,7 +1176,7 @@ Dhcp6SendRequestMsg (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
Instance->AdSelect->Dhcp6.Option, Instance->AdSelect->Dhcp6.Option,
Instance->AdSelect->Length - 4, Instance->AdSelect->Length - sizeof (EFI_DHCP6_HEADER),
Dhcp6OptServerId Dhcp6OptServerId
); );
if (Option == NULL) { if (Option == NULL) {
@ -1289,7 +1360,7 @@ Dhcp6SendDeclineMsg (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
LastReply->Dhcp6.Option, LastReply->Dhcp6.Option,
LastReply->Length - 4, LastReply->Length - sizeof (EFI_DHCP6_HEADER),
Dhcp6OptServerId Dhcp6OptServerId
); );
if (Option == NULL) { if (Option == NULL) {
@ -1448,7 +1519,7 @@ Dhcp6SendReleaseMsg (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
LastReply->Dhcp6.Option, LastReply->Dhcp6.Option,
LastReply->Length - 4, LastReply->Length - sizeof (EFI_DHCP6_HEADER),
Dhcp6OptServerId Dhcp6OptServerId
); );
if (Option == NULL) { if (Option == NULL) {
@ -1673,7 +1744,7 @@ Dhcp6SendRenewRebindMsg (
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
LastReply->Dhcp6.Option, LastReply->Dhcp6.Option,
LastReply->Length - 4, LastReply->Length - sizeof (EFI_DHCP6_HEADER),
Dhcp6OptServerId Dhcp6OptServerId
); );
if (Option == NULL) { if (Option == NULL) {
@ -2208,7 +2279,7 @@ Dhcp6HandleReplyMsg (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
Packet->Dhcp6.Option, Packet->Dhcp6.Option,
Packet->Length - 4, Packet->Length - sizeof (EFI_DHCP6_HEADER),
Dhcp6OptRapidCommit Dhcp6OptRapidCommit
); );
@ -2354,7 +2425,7 @@ Dhcp6HandleReplyMsg (
// //
// Any error status code option is found. // Any error status code option is found.
// //
StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(Option + 4))); StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)((DHCP6_OFFSET_OF_STATUS_CODE (Option)))));
switch (StsCode) { switch (StsCode) {
case Dhcp6StsUnspecFail: case Dhcp6StsUnspecFail:
// //
@ -2487,7 +2558,7 @@ Dhcp6SelectAdvertiseMsg (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
AdSelect->Dhcp6.Option, AdSelect->Dhcp6.Option,
AdSelect->Length - 4, AdSelect->Length - sizeof (EFI_DHCP6_HEADER),
Dhcp6OptServerUnicast Dhcp6OptServerUnicast
); );
@ -2498,7 +2569,7 @@ Dhcp6SelectAdvertiseMsg (
return EFI_OUT_OF_RESOURCES; return EFI_OUT_OF_RESOURCES;
} }
CopyMem (Instance->Unicast, Option + 4, sizeof (EFI_IPv6_ADDRESS)); CopyMem (Instance->Unicast, DHCP6_OFFSET_OF_OPT_DATA (Option), sizeof (EFI_IPv6_ADDRESS));
} }
// //
@ -2551,7 +2622,7 @@ Dhcp6HandleAdvertiseMsg (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
Packet->Dhcp6.Option, Packet->Dhcp6.Option,
Packet->Length - 4, Packet->Length - sizeof (EFI_DHCP6_HEADER),
Dhcp6OptRapidCommit Dhcp6OptRapidCommit
); );
@ -2645,7 +2716,7 @@ Dhcp6HandleAdvertiseMsg (
CopyMem (Instance->AdSelect, Packet, Packet->Size); CopyMem (Instance->AdSelect, Packet, Packet->Size);
if (Option != NULL) { if (Option != NULL) {
Instance->AdPref = *(Option + 4); Instance->AdPref = *(DHCP6_OFFSET_OF_OPT_DATA (Option));
} }
} else { } else {
// //
@ -2714,11 +2785,11 @@ Dhcp6HandleStateful (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
Packet->Dhcp6.Option, Packet->Dhcp6.Option,
Packet->Length - 4, Packet->Length - DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN,
Dhcp6OptClientId Dhcp6OptClientId
); );
if ((Option == NULL) || (CompareMem (Option + 4, ClientId->Duid, ClientId->Length) != 0)) { if ((Option == NULL) || (CompareMem (DHCP6_OFFSET_OF_OPT_DATA (Option), ClientId->Duid, ClientId->Length) != 0)) {
goto ON_CONTINUE; goto ON_CONTINUE;
} }
@ -2727,7 +2798,7 @@ Dhcp6HandleStateful (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
Packet->Dhcp6.Option, Packet->Dhcp6.Option,
Packet->Length - 4, Packet->Length - DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN,
Dhcp6OptServerId Dhcp6OptServerId
); );
@ -2832,7 +2903,7 @@ Dhcp6HandleStateless (
// //
Option = Dhcp6SeekOption ( Option = Dhcp6SeekOption (
Packet->Dhcp6.Option, Packet->Dhcp6.Option,
Packet->Length - 4, Packet->Length - sizeof (EFI_DHCP6_HEADER),
Dhcp6OptServerId Dhcp6OptServerId
); );