Fix a bug in IP driver that the fragment overlap check may be skipped incorrectly.

[mirror_edk2.git] / NetworkPkg / Ip6Dxe / Ip6Input.c

diff --git a/NetworkPkg/Ip6Dxe/Ip6Input.c b/NetworkPkg/Ip6Dxe/Ip6Input.c
index 89cdc3554264a5fc9c7803027204bc98d2c38f8d..cf88884e381b20f088b1b791d9540051143ba1f2 100644 (file)
--- a/NetworkPkg/Ip6Dxe/Ip6Input.c
+++ b/NetworkPkg/Ip6Dxe/Ip6Input.c
@@ -1,7 +1,7 @@
 /** @file\r
   IP6 internal functions to process the incoming packets.\r
 \r
-  Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -243,7 +243,7 @@ Ip6Reassemble (
   // check whether THIS.Start < PREV.End for overlap. If two fragments\r
   // overlaps, trim the overlapped part off THIS fragment.\r
   //\r
-  if ((Cur != ListHead) && ((Prev = Cur->BackLink) != ListHead)) {\r
+  if ((Prev = Cur->BackLink) != ListHead) {\r
     Fragment  = NET_LIST_USER_STRUCT (Prev, NET_BUF, List);\r
     Node      = IP6_GET_CLIP_INFO (Fragment);\r
 \r
@@ -613,6 +613,7 @@ Ip6IpSecProcessPacket (
   Ip6NtohHead (*Head);\r
 \r
   if (EFI_ERROR (Status)) {\r
+    FreePool (OriginalFragmentTable);\r
     goto ON_EXIT;\r
   }\r
 \r
@@ -620,7 +621,13 @@ Ip6IpSecProcessPacket (
     //\r
     // For ByPass Packet\r
     //\r
+    FreePool (FragmentTable);\r
     goto ON_EXIT;\r
+  } else {\r
+    //\r
+    // Free the FragmentTable which allocated before calling the IPsec.\r
+    //\r
+    FreePool (OriginalFragmentTable);\r
   }\r
 \r
   if (Direction == EfiIPsecOutBound && TxWrap != NULL) {\r
@@ -634,6 +641,7 @@ Ip6IpSecProcessPacket (
                                    TxWrap\r
                                    );\r
     if (TxWrap->Packet == NULL) {\r
+      TxWrap->Packet = *Netbuf;\r
       Status = EFI_OUT_OF_RESOURCES;\r
       goto ON_EXIT;\r
     }\r
@@ -652,6 +660,8 @@ Ip6IpSecProcessPacket (
     IpSecWrap = AllocateZeroPool (sizeof (IP6_IPSEC_WRAP));\r
 \r
     if (IpSecWrap == NULL) {\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+      gBS->SignalEvent (RecycleEvent);\r
       goto ON_EXIT;\r
     }\r
 \r
@@ -667,6 +677,9 @@ Ip6IpSecProcessPacket (
                                       );\r
 \r
     if (Packet == NULL) {\r
+      Packet = IpSecWrap->Packet;\r
+      gBS->SignalEvent (RecycleEvent);\r
+      FreePool (IpSecWrap);\r
       Status = EFI_OUT_OF_RESOURCES;\r
       goto ON_EXIT;\r
     }\r
@@ -679,7 +692,8 @@ Ip6IpSecProcessPacket (
                                         NET_BUF_HEAD\r
                                         );\r
       if (PacketHead == NULL) {\r
-        Status = EFI_OUT_OF_RESOURCES;\r
+        *Netbuf = Packet;\r
+        Status  = EFI_OUT_OF_RESOURCES;\r
         goto ON_EXIT;\r
       }\r
 \r