NetworkPkg/Ip6Dxe: Validate source data record length

[mirror_edk2.git] / NetworkPkg / Ip6Dxe / Ip6ConfigImpl.c

diff --git a/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c b/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
index eb2a80b64f1502df7e28eae4b3144afbffa58596..ab3801336912fde819f8a5883054314666a61cce 100644 (file)
--- a/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
+++ b/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
@@ -2,6 +2,7 @@
   The implementation of EFI IPv6 Configuration Protocol.\r
 \r
   Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) Microsoft Corporation.<BR>\r
 \r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
@@ -390,24 +391,9 @@ Ip6ConfigReadConfigData (
                     );\r
     if (EFI_ERROR (Status) || (UINT16) (~NetblockChecksum ((UINT8 *) Variable, (UINT32) VarSize)) != 0) {\r
       //\r
-      // GetVariable still error or the variable is corrupted.\r
-      // Fall back to the default value.\r
+      // GetVariable error or the variable is corrupted.\r
       //\r
-      FreePool (Variable);\r
-\r
-      //\r
-      // Remove the problematic variable and return EFI_NOT_FOUND, a new\r
-      // variable will be set again.\r
-      //\r
-      gRT->SetVariable (\r
-             VarName,\r
-             &gEfiIp6ConfigProtocolGuid,\r
-             IP6_CONFIG_VARIABLE_ATTRIBUTE,\r
-             0,\r
-             NULL\r
-             );\r
-\r
-      return EFI_NOT_FOUND;\r
+      goto Error;\r
     }\r
 \r
     //\r
@@ -432,7 +418,12 @@ Ip6ConfigReadConfigData (
       if (!DATA_ATTRIB_SET (DataItem->Attribute, DATA_ATTRIB_SIZE_FIXED)) {\r
         //\r
         // This data item has variable length data.\r
+        // Check that the length is contained within the variable before allocating.\r
         //\r
+        if (DataRecord.DataSize > VarSize - DataRecord.Offset) {\r
+          goto Error;\r
+        }\r
+\r
         DataItem->Data.Ptr = AllocatePool (DataRecord.DataSize);\r
         if (DataItem->Data.Ptr == NULL) {\r
           //\r
@@ -454,6 +445,28 @@ Ip6ConfigReadConfigData (
   }\r
 \r
   return Status;\r
+\r
+Error:\r
+  //\r
+  // Fall back to the default value.\r
+  //\r
+  if (Variable != NULL) {\r
+    FreePool (Variable);\r
+  }\r
+\r
+  //\r
+  // Remove the problematic variable and return EFI_NOT_FOUND, a new\r
+  // variable will be set again.\r
+  //\r
+  gRT->SetVariable (\r
+         VarName,\r
+         &gEfiIp6ConfigProtocolGuid,\r
+         IP6_CONFIG_VARIABLE_ATTRIBUTE,\r
+         0,\r
+         NULL\r
+         );\r
+\r
+  return EFI_NOT_FOUND;\r
 }\r
 \r
 /**\r