diff options
| author | vanjeff <vanjeff@6f19259b-4bc3-4df7-8a09-765794883524> | 2012-01-21 07:16:26 +0000 |
|---|---|---|
| committer | vanjeff <vanjeff@6f19259b-4bc3-4df7-8a09-765794883524> | 2012-01-21 07:16:26 +0000 |
| commit | 9b340921eb1cbd655226302c807cf7f1a835f3de (patch) | |
| tree | a15dc02c0559ed794f02d4dd3bab705d3afd1988 /NetworkPkg | |
| parent | 8b23eb867c6fdd2136291ec8b505c5c593409245 (diff) | |
| download | edk2-9b340921eb1cbd655226302c807cf7f1a835f3de.tar.gz | |
Sync part of patch r12514 from main trunk.UDK2010
Add pointer check for NULL before dereference it.
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/branches/UDK2010@12953 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'NetworkPkg')
| -rw-r--r-- | NetworkPkg/Ip6Dxe/Ip6Nd.c | 48 | ||||
| -rw-r--r-- | NetworkPkg/IpSecDxe/IpSecConfigImpl.c | 14 |
2 files changed, 40 insertions, 22 deletions
diff --git a/NetworkPkg/Ip6Dxe/Ip6Nd.c b/NetworkPkg/Ip6Dxe/Ip6Nd.c index f2a47a8073..e0ec832228 100644 --- a/NetworkPkg/Ip6Dxe/Ip6Nd.c +++ b/NetworkPkg/Ip6Dxe/Ip6Nd.c @@ -1498,13 +1498,16 @@ Ip6ProcessNeighborSolicit ( goto Exit;
} else {
OptionLen = (UINT16) (Head->PayloadLength - IP6_ND_LENGTH);
- Option = NetbufGetByte (Packet, IP6_ND_LENGTH, NULL);
+ if (OptionLen != 0) {
+ Option = NetbufGetByte (Packet, IP6_ND_LENGTH, NULL);
+ ASSERT (Option != NULL);
- //
- // All included options should have a length that is greater than zero.
- //
- if (!Ip6IsNDOptionValid (Option, OptionLen)) {
- goto Exit;
+ //
+ // All included options should have a length that is greater than zero.
+ //
+ if (!Ip6IsNDOptionValid (Option, OptionLen)) {
+ goto Exit;
+ }
}
}
@@ -1734,13 +1737,16 @@ Ip6ProcessNeighborAdvertise ( goto Exit;
} else {
OptionLen = (UINT16) (Head->PayloadLength - IP6_ND_LENGTH);
- Option = NetbufGetByte (Packet, IP6_ND_LENGTH, NULL);
+ if (OptionLen != 0) {
+ Option = NetbufGetByte (Packet, IP6_ND_LENGTH, NULL);
+ ASSERT (Option != NULL);
- //
- // All included options should have a length that is greater than zero.
- //
- if (!Ip6IsNDOptionValid (Option, OptionLen)) {
- goto Exit;
+ //
+ // All included options should have a length that is greater than zero.
+ //
+ if (!Ip6IsNDOptionValid (Option, OptionLen)) {
+ goto Exit;
+ }
}
}
@@ -1983,10 +1989,13 @@ Ip6ProcessRouterAdvertise ( // All included options have a length that is greater than zero.
//
OptionLen = (UINT16) (Head->PayloadLength - IP6_RA_LENGTH);
- Option = NetbufGetByte (Packet, IP6_RA_LENGTH, NULL);
+ if (OptionLen != 0) {
+ Option = NetbufGetByte (Packet, IP6_RA_LENGTH, NULL);
+ ASSERT (Option != NULL);
- if (!Ip6IsNDOptionValid (Option, OptionLen)) {
- goto Exit;
+ if (!Ip6IsNDOptionValid (Option, OptionLen)) {
+ goto Exit;
+ }
}
//
@@ -2429,10 +2438,13 @@ Ip6ProcessRedirect ( // All included options have a length that is greater than zero.
//
OptionLen = (UINT16) (Head->PayloadLength - IP6_REDITECT_LENGTH);
- Option = NetbufGetByte (Packet, IP6_REDITECT_LENGTH, NULL);
+ if (OptionLen != 0) {
+ Option = NetbufGetByte (Packet, IP6_REDITECT_LENGTH, NULL);
+ ASSERT (Option != NULL);
- if (!Ip6IsNDOptionValid (Option, OptionLen)) {
- goto Exit;
+ if (!Ip6IsNDOptionValid (Option, OptionLen)) {
+ goto Exit;
+ }
}
Target = (EFI_IPv6_ADDRESS *) (Icmp + 1);
diff --git a/NetworkPkg/IpSecDxe/IpSecConfigImpl.c b/NetworkPkg/IpSecDxe/IpSecConfigImpl.c index e671e42e27..a976459692 100644 --- a/NetworkPkg/IpSecDxe/IpSecConfigImpl.c +++ b/NetworkPkg/IpSecDxe/IpSecConfigImpl.c @@ -1,7 +1,7 @@ /** @file
The implementation of IPSEC_CONFIG_PROTOCOL.
- Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
@@ -1995,6 +1995,10 @@ IpSecGetVariable ( VariableNameISizeNew,
VariableNameI
);
+ if (VariableNameI == NULL) {
+ Status = EFI_OUT_OF_RESOURCES;
+ break;
+ }
VariableNameISize = VariableNameISizeNew;
Status = gRT->GetNextVariableName (
@@ -2071,7 +2075,9 @@ IpSecGetVariable ( }
ON_EXIT:
- FreePool (VariableNameI);
+ if (VariableNameI != NULL) {
+ FreePool (VariableNameI);
+ }
return Status;
}
@@ -2498,8 +2504,8 @@ IpSecCopyPolicyEntry ( //
Buffer->Capacity += EntrySize;
TempPoint = AllocatePool (Buffer->Capacity);
-
- if (Buffer->Ptr == NULL) {
+
+ if (TempPoint == NULL) {
return EFI_OUT_OF_RESOURCES;
}
//
|