NetworkPkg: Check for the max DHCP packet length before use it.

This patch updates the PXE and HTTP boot driver to drop the input DHCP packet
if it exceed the maximum length.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-By: Wu Jiaxin <jiaxin.wu@intel.com>

diff --git a/NetworkPkg/HttpBootDxe/HttpBootDhcp4.h b/NetworkPkg/HttpBootDxe/HttpBootDhcp4.h
index 27d949850ab3b1efb3117f97740ef31fde7ac97a..0b2cafbf50988e3c55ffc20bee5691a9051cc7ff 100644 (file)
--- a/NetworkPkg/HttpBootDxe/HttpBootDhcp4.h
+++ b/NetworkPkg/HttpBootDxe/HttpBootDhcp4.h
@@ -178,10 +178,12 @@ typedef struct {
   UINT32         Reserved;\r
 } HTTP_BOOT_VENDOR_OPTION;\r
 \r
+#define HTTP_CACHED_DHCP4_PACKET_MAX_SIZE  (OFFSET_OF (EFI_DHCP4_PACKET, Dhcp4) + HTTP_BOOT_DHCP4_PACKET_MAX_SIZE)\r
+\r
 typedef union {\r
   EFI_DHCP4_PACKET        Offer;\r
   EFI_DHCP4_PACKET        Ack;\r
-  UINT8                   Buffer[HTTP_BOOT_DHCP4_PACKET_MAX_SIZE];\r
+  UINT8                   Buffer[HTTP_CACHED_DHCP4_PACKET_MAX_SIZE];\r
 } HTTP_BOOT_DHCP4_PACKET;\r
 \r
 typedef struct {\r

diff --git a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
index 847864203c8a3e4251ee723c09cac3fd2c3cdf5e..ca84f2ad9b8242c737f40c978e335d680eda15f6 100644 (file)
--- a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
+++ b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
@@ -427,6 +427,12 @@ HttpBootDhcp6CallBack (
     \r
    case Dhcp6RcvdAdvertise:\r
      Status = EFI_NOT_READY;\r
+    if (Packet->Length > HTTP_BOOT_DHCP6_PACKET_MAX_SIZE) {\r
+      //\r
+      // Ignore the incoming packets which exceed the maximum length.\r
+      //\r
+      break;\r
+    }\r
      if (Private->OfferNum < HTTP_BOOT_OFFER_MAX_NUM) {\r
        //\r
        // Cache the dhcp offers to OfferBuffer[] for select later, and record\r

diff --git a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.h b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.h
index 14d6db06482028b47fbbe1158a9788054a479143..9f2989831e3bb00aa7017c2be0aa797b8cd90ecd 100644 (file)
--- a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.h
+++ b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.h
@@ -75,10 +75,12 @@ typedef union {
   HTTP_BOOT_DHCP6_OPTION_VENDOR_CLASS   *VendorClass;\r
 } HTTP_BOOT_DHCP6_OPTION_ENTRY;\r
 \r
+#define HTTP_CACHED_DHCP6_PACKET_MAX_SIZE  (OFFSET_OF (EFI_DHCP6_PACKET, Dhcp6) + HTTP_BOOT_DHCP6_PACKET_MAX_SIZE)\r
+\r
 typedef union {\r
   EFI_DHCP6_PACKET        Offer;\r
   EFI_DHCP6_PACKET        Ack;\r
-  UINT8                   Buffer[HTTP_BOOT_DHCP6_PACKET_MAX_SIZE];\r
+  UINT8                   Buffer[HTTP_CACHED_DHCP6_PACKET_MAX_SIZE];\r
 } HTTP_BOOT_DHCP6_PACKET;\r
 \r
 typedef struct {\r

diff --git a/NetworkPkg/HttpBootDxe/HttpBootImpl.c b/NetworkPkg/HttpBootDxe/HttpBootImpl.c
index babd3e6194287f451b83679d4df38a0720f92e25..cf6de80a17f66ff131e51bbfa816cc94fb0d497d 100644 (file)
--- a/NetworkPkg/HttpBootDxe/HttpBootImpl.c
+++ b/NetworkPkg/HttpBootDxe/HttpBootImpl.c
@@ -126,11 +126,11 @@ HttpBootStart (
   ZeroMem (Private->OfferBuffer, sizeof (Private->OfferBuffer));\r
   if (!Private->UsingIpv6) {\r
     for (Index = 0; Index < HTTP_BOOT_OFFER_MAX_NUM; Index++) {\r
-      Private->OfferBuffer[Index].Dhcp4.Packet.Offer.Size = HTTP_BOOT_DHCP4_PACKET_MAX_SIZE;\r
+      Private->OfferBuffer[Index].Dhcp4.Packet.Offer.Size = HTTP_CACHED_DHCP4_PACKET_MAX_SIZE;\r
     }\r
   } else {\r
     for (Index = 0; Index < HTTP_BOOT_OFFER_MAX_NUM; Index++) {\r
-      Private->OfferBuffer[Index].Dhcp6.Packet.Offer.Size = HTTP_BOOT_DHCP6_PACKET_MAX_SIZE;\r
+      Private->OfferBuffer[Index].Dhcp6.Packet.Offer.Size = HTTP_CACHED_DHCP6_PACKET_MAX_SIZE;\r
     }\r
   }\r
 \r

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
index 6566afd6af2dbe42a70a28ebeb69e2171485c8d1..44b07143934dfdce53716f522b784629e4db4bd5 100644 (file)
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
@@ -256,7 +256,7 @@ PxeBcBuildDhcp4Options (
     OptList[Index]->OpCode  = DHCP4_TAG_MAXMSG;\r
     OptList[Index]->Length  = (UINT8) sizeof (PXEBC_DHCP4_OPTION_MAX_MESG_SIZE);\r
     OptEnt.MaxMesgSize      = (PXEBC_DHCP4_OPTION_MAX_MESG_SIZE *) OptList[Index]->Data;\r
-    Value                   = NTOHS (PXEBC_DHCP4_PACKET_MAX_SIZE - 8);\r
+    Value                   = NTOHS (PXEBC_DHCP4_PACKET_MAX_SIZE);\r
     CopyMem (&OptEnt.MaxMesgSize->Size, &Value, sizeof (UINT16));\r
     Index++;\r
     OptList[Index]          = GET_NEXT_DHCP_OPTION (OptList[Index - 1]);\r
@@ -1183,7 +1183,7 @@ PxeBcDhcp4CallBack (
                  DHCP4_TAG_MAXMSG\r
                  );\r
   if (MaxMsgSize != NULL) {\r
-    Value = HTONS (PXEBC_DHCP4_PACKET_MAX_SIZE - 8);\r
+    Value = HTONS (PXEBC_DHCP4_PACKET_MAX_SIZE);\r
     CopyMem (MaxMsgSize->Data, &Value, sizeof (Value));\r
   }\r
 \r
@@ -1209,6 +1209,14 @@ PxeBcDhcp4CallBack (
   switch (Dhcp4Event) {\r
 \r
   case Dhcp4SendDiscover:\r
+    if (Packet->Length > PXEBC_DHCP4_PACKET_MAX_SIZE) {\r
+      //\r
+      // If the to be sent packet exceeds the maximum length, abort the DHCP process.\r
+      //\r
+      Status = EFI_ABORTED;\r
+      break;\r
+    }\r
+\r
     //\r
     // Cache the DHCPv4 discover packet to mode data directly.\r
     // It need to check SendGuid as well as Dhcp4SendRequest.\r
@@ -1216,6 +1224,14 @@ PxeBcDhcp4CallBack (
     CopyMem (&Mode->DhcpDiscover.Dhcpv4, &Packet->Dhcp4, Packet->Length);\r
 \r
   case Dhcp4SendRequest:\r
+    if (Packet->Length > PXEBC_DHCP4_PACKET_MAX_SIZE) {\r
+      //\r
+      // If the to be sent packet exceeds the maximum length, abort the DHCP process.\r
+      //\r
+      Status = EFI_ABORTED;\r
+      break;\r
+    }\r
+    \r
     if (Mode->SendGUID) {\r
       //\r
       // Send the system Guid instead of the MAC address as the hardware address if required.\r
@@ -1232,6 +1248,12 @@ PxeBcDhcp4CallBack (
 \r
   case Dhcp4RcvdOffer:\r
     Status = EFI_NOT_READY;\r
+    if (Packet->Length > PXEBC_DHCP4_PACKET_MAX_SIZE) {\r
+      //\r
+      // Ignore the incoming packets which exceed the maximum length.\r
+      //\r
+      break;\r
+    }\r
     if (Private->OfferNum < PXEBC_OFFER_MAX_NUM) {\r
       //\r
       // Cache the DHCPv4 offers to OfferBuffer[] for select later, and record\r
@@ -1256,6 +1278,14 @@ PxeBcDhcp4CallBack (
     break;\r
 \r
   case Dhcp4RcvdAck:\r
+    if (Packet->Length > PXEBC_DHCP4_PACKET_MAX_SIZE) {\r
+      //\r
+      // Abort the DHCP if the ACK packet exceeds the maximum length.\r
+      //\r
+         Status = EFI_ABORTED;\r
+         break;\r
+    }\r
+\r
     //\r
     // Cache the DHCPv4 ack to Private->Dhcp4Ack, but it's not the final ack in mode data\r
     // without verification.\r

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.h b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.h
index 3aabaed088820f2b3abe0f17b6df5b53ed193988..27794c911a128e3b1f752c2a792c9c9373b704ea 100644 (file)
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.h
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.h
@@ -18,7 +18,7 @@
 \r
 #define PXEBC_DHCP4_OPTION_MAX_NUM         16\r
 #define PXEBC_DHCP4_OPTION_MAX_SIZE        312\r
-#define PXEBC_DHCP4_PACKET_MAX_SIZE        1472\r
+#define PXEBC_DHCP4_PACKET_MAX_SIZE        (sizeof (EFI_PXE_BASE_CODE_PACKET))\r
 #define PXEBC_DHCP4_S_PORT                 67\r
 #define PXEBC_DHCP4_C_PORT                 68\r
 #define PXEBC_BS_DOWNLOAD_PORT             69\r
@@ -263,10 +263,12 @@ typedef struct {
   UINT8                 CredTypeLen;\r
 } PXEBC_VENDOR_OPTION;\r
 \r
+#define PXEBC_CACHED_DHCP4_PACKET_MAX_SIZE  (OFFSET_OF (EFI_DHCP4_PACKET, Dhcp4) + PXEBC_DHCP4_PACKET_MAX_SIZE)\r
+\r
 typedef union {\r
   EFI_DHCP4_PACKET        Offer;\r
   EFI_DHCP4_PACKET        Ack;\r
-  UINT8                   Buffer[PXEBC_DHCP4_PACKET_MAX_SIZE];\r
+  UINT8                   Buffer[PXEBC_CACHED_DHCP4_PACKET_MAX_SIZE];\r
 } PXEBC_DHCP4_PACKET;\r
 \r
 typedef struct {\r

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
index eba8e1d27ba4d52b3b59a07bbceb7262c3e9ffc8..6a08e9a2de68a56cebf1c71174ec6364af4119bc 100644 (file)
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
@@ -1919,6 +1919,14 @@ PxeBcDhcp6CallBack (
   switch (Dhcp6Event) {\r
 \r
   case Dhcp6SendSolicit:\r
+    if (Packet->Length > PXEBC_DHCP6_PACKET_MAX_SIZE) {\r
+      //\r
+      // If the to be sent packet exceeds the maximum length, abort the DHCP process.\r
+      //\r
+      Status = EFI_ABORTED;\r
+      break;\r
+    }\r
+    \r
     //\r
     // Record the first Solicate msg time\r
     //\r
@@ -1934,6 +1942,12 @@ PxeBcDhcp6CallBack (
 \r
   case Dhcp6RcvdAdvertise:\r
     Status = EFI_NOT_READY;\r
+    if (Packet->Length > PXEBC_DHCP6_PACKET_MAX_SIZE) {\r
+      //\r
+      // Ignore the incoming packets which exceed the maximum length.\r
+      //\r
+      break;\r
+    }\r
     if (Private->OfferNum < PXEBC_OFFER_MAX_NUM) {\r
       //\r
       // Cache the dhcp offers to OfferBuffer[] for select later, and record\r
@@ -1944,6 +1958,14 @@ PxeBcDhcp6CallBack (
     break;\r
 \r
   case Dhcp6SendRequest:\r
+    if (Packet->Length > PXEBC_DHCP6_PACKET_MAX_SIZE) {\r
+      //\r
+      // If the to be sent packet exceeds the maximum length, abort the DHCP process.\r
+      //\r
+      Status = EFI_ABORTED;\r
+      break;\r
+    }\r
+    \r
     //\r
     // Store the request packet as seed packet for discover.\r
     //\r
@@ -1975,6 +1997,13 @@ PxeBcDhcp6CallBack (
     break;\r
 \r
   case Dhcp6RcvdReply:\r
+    if (Packet->Length > PXEBC_DHCP6_PACKET_MAX_SIZE) {\r
+      //\r
+      // Abort the DHCP if the Peply packet exceeds the maximum length.\r
+      //\r
+         Status = EFI_ABORTED;\r
+      break;\r
+    }\r
     //\r
     // Cache the dhcp ack to Private->Dhcp6Ack, but it's not the final ack in mode data\r
     // without verification.\r

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
index 9493b164cbb094d3e8ae99ed0d89103ee28a4086..39efcfaa778830c13a0c686c768d341baa9b64a6 100644 (file)
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
@@ -18,7 +18,7 @@
 \r
 #define PXEBC_DHCP6_OPTION_MAX_NUM        16\r
 #define PXEBC_DHCP6_OPTION_MAX_SIZE       312\r
-#define PXEBC_DHCP6_PACKET_MAX_SIZE       1472\r
+#define PXEBC_DHCP6_PACKET_MAX_SIZE       (sizeof (EFI_PXE_BASE_CODE_PACKET))\r
 #define PXEBC_IP6_POLICY_MAX              0xff\r
 #define PXEBC_IP6_ROUTE_TABLE_TIMEOUT     10\r
 \r
@@ -101,10 +101,12 @@ typedef struct {
   UINT8                   Precedence;\r
 } PXEBC_DHCP6_OPTION_NODE;\r
 \r
+#define PXEBC_CACHED_DHCP6_PACKET_MAX_SIZE  (OFFSET_OF (EFI_DHCP6_PACKET, Dhcp6) + PXEBC_DHCP6_PACKET_MAX_SIZE)\r
+\r
 typedef union {\r
   EFI_DHCP6_PACKET        Offer;\r
   EFI_DHCP6_PACKET        Ack;\r
-  UINT8                   Buffer[PXEBC_DHCP6_PACKET_MAX_SIZE];\r
+  UINT8                   Buffer[PXEBC_CACHED_DHCP6_PACKET_MAX_SIZE];\r
 } PXEBC_DHCP6_PACKET;\r
 \r
 typedef struct {\r

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcImpl.c b/NetworkPkg/UefiPxeBcDxe/PxeBcImpl.c
index 0552174ac6553353b429fe4cfca2323132545eab..e24c573e325eb8381a5febdd3b643026e4207122 100644 (file)
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcImpl.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcImpl.c
@@ -102,12 +102,12 @@ EfiPxeBcStart (
     // PXE over IPv6 starts here, initialize the fields and list header.\r
     //\r
     Private->Ip6Policy                          = PXEBC_IP6_POLICY_MAX;\r
-    Private->ProxyOffer.Dhcp6.Packet.Offer.Size = PXEBC_DHCP6_PACKET_MAX_SIZE;\r
-    Private->DhcpAck.Dhcp6.Packet.Ack.Size      = PXEBC_DHCP6_PACKET_MAX_SIZE;\r
-    Private->PxeReply.Dhcp6.Packet.Ack.Size     = PXEBC_DHCP6_PACKET_MAX_SIZE;\r
+    Private->ProxyOffer.Dhcp6.Packet.Offer.Size = PXEBC_CACHED_DHCP6_PACKET_MAX_SIZE;\r
+    Private->DhcpAck.Dhcp6.Packet.Ack.Size      = PXEBC_CACHED_DHCP6_PACKET_MAX_SIZE;\r
+    Private->PxeReply.Dhcp6.Packet.Ack.Size     = PXEBC_CACHED_DHCP6_PACKET_MAX_SIZE;\r
 \r
     for (Index = 0; Index < PXEBC_OFFER_MAX_NUM; Index++) {\r
-      Private->OfferBuffer[Index].Dhcp6.Packet.Offer.Size = PXEBC_DHCP6_PACKET_MAX_SIZE;\r
+      Private->OfferBuffer[Index].Dhcp6.Packet.Offer.Size = PXEBC_CACHED_DHCP6_PACKET_MAX_SIZE;\r
     }\r
 \r
     //\r
@@ -154,12 +154,12 @@ EfiPxeBcStart (
     //\r
     // PXE over IPv4 starts here, initialize the fields.\r
     //\r
-    Private->ProxyOffer.Dhcp4.Packet.Offer.Size = PXEBC_DHCP4_PACKET_MAX_SIZE;\r
-    Private->DhcpAck.Dhcp4.Packet.Ack.Size      = PXEBC_DHCP4_PACKET_MAX_SIZE;\r
-    Private->PxeReply.Dhcp4.Packet.Ack.Size     = PXEBC_DHCP4_PACKET_MAX_SIZE;\r
+    Private->ProxyOffer.Dhcp4.Packet.Offer.Size = PXEBC_CACHED_DHCP4_PACKET_MAX_SIZE;\r
+    Private->DhcpAck.Dhcp4.Packet.Ack.Size      = PXEBC_CACHED_DHCP4_PACKET_MAX_SIZE;\r
+    Private->PxeReply.Dhcp4.Packet.Ack.Size     = PXEBC_CACHED_DHCP4_PACKET_MAX_SIZE;\r
 \r
     for (Index = 0; Index < PXEBC_OFFER_MAX_NUM; Index++) {\r
-      Private->OfferBuffer[Index].Dhcp4.Packet.Offer.Size = PXEBC_DHCP4_PACKET_MAX_SIZE;\r
+      Private->OfferBuffer[Index].Dhcp4.Packet.Offer.Size = PXEBC_CACHED_DHCP4_PACKET_MAX_SIZE;\r
     }\r
 \r
     PxeBcSeedDhcp4Packet (&Private->SeedPacket, Private->Udp4Read);\r