/** @file\r
IP4 input process.\r
\r
-Copyright (c) 2005 - 2018, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2005 - 2020, Intel Corporation. All rights reserved.<BR>\r
(C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>\r
\r
SPDX-License-Identifier: BSD-2-Clause-Patent\r
//\r
// Check if the IP4 header is correctly formatted.\r
//\r
- if ((*Packet)->TotalSize < IP4_MIN_HEADLEN) {\r
- return EFI_INVALID_PARAMETER;\r
- }\r
-\r
HeadLen = (Head->HeadLen << 2);\r
TotalLen = NTOHS (Head->TotalLen);\r
\r
return EFI_SUCCESS;\r
}\r
\r
+/**\r
+ This function checks the IPv4 packet length.\r
+\r
+ @param[in] Packet Pointer to the IPv4 Packet to be checked.\r
+\r
+ @retval TRUE The input IPv4 packet length is valid.\r
+ @retval FALSE The input IPv4 packet length is invalid.\r
+\r
+**/\r
+BOOLEAN\r
+Ip4IsValidPacketLength (\r
+ IN NET_BUF *Packet\r
+ )\r
+{\r
+ //\r
+ // Check the IP4 packet length.\r
+ //\r
+ if (Packet->TotalSize < IP4_MIN_HEADLEN) {\r
+ return FALSE;\r
+ }\r
+\r
+ return TRUE;\r
+}\r
+\r
/**\r
The IP4 input routine. It is called by the IP4_INTERFACE when a\r
IP4 fragment is received from MNP.\r
goto DROP;\r
}\r
\r
+ if (!Ip4IsValidPacketLength (Packet)) {\r
+ goto RESTART;\r
+ }\r
+\r
Head = (IP4_HEAD *) NetbufGetByte (Packet, 0, NULL);\r
ASSERT (Head != NULL);\r
OptionLen = (Head->HeadLen << 2) - IP4_MIN_HEADLEN;\r
//\r
ZeroMem (&ZeroHead, sizeof (IP4_HEAD));\r
if (0 == CompareMem (Head, &ZeroHead, sizeof (IP4_HEAD))) {\r
- // Packet may have been changed. Head, HeadLen, TotalLen, and\r
- // info must be reloaded before use. The ownership of the packet\r
- // is transferred to the packet process logic.\r
- //\r
+ // Packet may have been changed. Head, HeadLen, TotalLen, and\r
+ // info must be reloaded before use. The ownership of the packet\r
+ // is transferred to the packet process logic.\r
+ //\r
+ if (!Ip4IsValidPacketLength (Packet)) {\r
+ goto RESTART;\r
+ }\r
+\r
Head = (IP4_HEAD *) NetbufGetByte (Packet, 0, NULL);\r
ASSERT (Head != NULL);\r
Status = Ip4PreProcessPacket (\r