From 166a6552a829ab680862331449f11970c085f26d Mon Sep 17 00:00:00 2001 From: Laszlo Ersek Date: Sun, 3 Apr 2016 11:48:43 +0200 Subject: [PATCH] MdeModulePkg: DxeUdpIoLib: fix non-empty payload path in UDP reception Commit 1b31acb66c02 ("MdeModulePkg: Check received packet size before use it.") introduced a chunk of code under the new "Resume" label, in function UdpIoOnDgramRcvdDpc(). The new code is supposed to run only when the received packet has zero-length payload, but a "return" statement was forgotten, and the code is reached on the normal (nonzero-length payload) path as well, after the packet has been processed (and possibly freed) by RxToken->CallBack(). This is a logic bug, with the direct symptom being use-after-free / General Protection Fault. Cc: Siyuan Fu Cc: Jiaxin Wu Cc: Ting Ye Cc: "Subramanian, Sriram (EG Servers Platform SW)" Fixes: 1b31acb66c026f2791c959a4ec9b55c04d583c22 Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Laszlo Ersek Reviewed-by: Sriram Subramanian --- MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c | 1 + 1 file changed, 1 insertion(+) diff --git a/MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c b/MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c index 4f7126d3ce..4861095435 100644 --- a/MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c +++ b/MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c @@ -303,6 +303,7 @@ UdpIoOnDgramRcvdDpc ( } RxToken->CallBack (Netbuf, &EndPoint, EFI_SUCCESS, RxToken->Context); + return; Resume: if (RxToken->UdpIo->UdpVersion == UDP_IO_UDP4_VERSION) { -- 2.39.5