From: Jiaxin Wu <jiaxin.wu@intel.com>
Date: Wed, 27 Apr 2016 06:29:29 +0000 (+0800)
Subject: NetworkPkg: Fix incorrect buffer free in HttpDxe
X-Git-Tag: edk2-stable201903~7231
X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=59844e126614fc8275aab083fafa5818cde0901c;p=mirror_edk2.git

NetworkPkg: Fix incorrect buffer free in HttpDxe

FragmentBuffer of each TcpWrap in HttpDxe should not be
freed in HttpTcpTokenCleanup(). This buffer points to
HttpMsg body actually, which is the responsibility of the
caller to allocate a buffer for Body.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Zhang Lubo <lubo.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
---

diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c
index 06f3bb6860..f3992edfdc 100644
--- a/NetworkPkg/HttpDxe/HttpProto.c
+++ b/NetworkPkg/HttpDxe/HttpProto.c
@@ -1837,45 +1837,45 @@ HttpTcpTokenCleanup (
   Rx6Token       = NULL;
   
   if (HttpInstance->LocalAddressIsIPv6) {
-    if (Wrap->TcpWrap.Rx6Token.CompletionToken.Event != NULL) {
-      gBS->CloseEvent (Wrap->TcpWrap.Rx6Token.CompletionToken.Event);
-    }
-
     Rx6Token = &Wrap->TcpWrap.Rx6Token;
-    if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
-      FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
-      Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
+    
+    if (Rx6Token->CompletionToken.Event != NULL) {
+      gBS->CloseEvent (Rx6Token->CompletionToken.Event);
+      Rx6Token->CompletionToken.Event = NULL;
     }
-    FreePool (Wrap);
 
-    if (HttpInstance->Rx6Token.CompletionToken.Event != NULL) {
-      gBS->CloseEvent (HttpInstance->Rx6Token.CompletionToken.Event);
-      HttpInstance->Rx6Token.CompletionToken.Event = NULL;
-    }
+    FreePool (Wrap);
 
     Rx6Token = &HttpInstance->Rx6Token;
+    
+    if (Rx6Token->CompletionToken.Event != NULL) {
+      gBS->CloseEvent (Rx6Token->CompletionToken.Event);
+      Rx6Token->CompletionToken.Event = NULL;
+    }
+    
     if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
       FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
       Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
     }
     
   } else {
-    if (Wrap->TcpWrap.Rx4Token.CompletionToken.Event != NULL) {
-      gBS->CloseEvent (Wrap->TcpWrap.Rx4Token.CompletionToken.Event);
-    }
     Rx4Token = &Wrap->TcpWrap.Rx4Token;
-    if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
-      FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
-      Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
+  
+    if (Rx4Token->CompletionToken.Event != NULL) {
+      gBS->CloseEvent (Rx4Token->CompletionToken.Event);
+      Rx4Token->CompletionToken.Event = NULL;
     }
+    
     FreePool (Wrap);
 
-    if (HttpInstance->Rx4Token.CompletionToken.Event != NULL) {
-      gBS->CloseEvent (HttpInstance->Rx4Token.CompletionToken.Event);
-      HttpInstance->Rx4Token.CompletionToken.Event = NULL;
+    Rx4Token = &HttpInstance->Rx4Token;
+
+    if (Rx4Token->CompletionToken.Event != NULL) {
+      gBS->CloseEvent (Rx4Token->CompletionToken.Event);
+      Rx4Token->CompletionToken.Event = NULL;
     }
     
-    Rx4Token = &HttpInstance->Rx4Token;
+    
     if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
       FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
       Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;