tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix a memory use after free bug in DHCP6 driver. 

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu, Siyuan <siyuan.fu@intel.com>
Reviewed-By: Ye, Ting <ting.ye@intel.com>
Reviewed-by: Wu, Jiaxin <jiaxin.wu@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15651 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Fu, Siyuan 2014-07-10 07:46:34 +00:00 committed by sfu5
parent cf1eb6e6f8
commit d2ea3b8399
1 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
Dhcp6 internal functions implementation. Dhcp6 internal functions implementation.
Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
@ -363,6 +363,32 @@ Dhcp6CleanupRetry (
} }
} }
/**
Check whether the TxCb is still a valid control block in the instance's retry list.
@param[in] Instance The pointer to DHCP6_INSTANCE.
@param[in] TxCb The control block for a transmitted message.
@retval TRUE The control block is in Instance's retry list.
@retval FALSE The control block is NOT in Instance's retry list.
**/
BOOLEAN
Dhcp6IsValidTxCb (
IN DHCP6_INSTANCE *Instance,
IN DHCP6_TX_CB *TxCb
)
{
LIST_ENTRY *Entry;
NET_LIST_FOR_EACH (Entry, &Instance->TxList) {
if (TxCb == NET_LIST_USER_STRUCT (Entry, DHCP6_TX_CB, Link)) {
return TRUE;
}
}
return FALSE;
}
/** /**
Clean up the session of the instance stateful exchange. Clean up the session of the instance stateful exchange.
@ -3097,7 +3123,8 @@ Dhcp6OnTimerTick (
ON_CLOSE: ON_CLOSE:
if (TxCb->TxPacket != NULL && if (Dhcp6IsValidTxCb (Instance, TxCb) &&
TxCb->TxPacket != NULL &&
(TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgInfoRequest || (TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgInfoRequest ||
TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgRenew || TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgRenew ||
TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgConfirm) TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgConfirm)