\r
Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>\r
\r
- This program and the accompanying materials\r
- are licensed and made available under the terms and conditions of the BSD License\r
- which accompanies this distribution. The full text of the license may be found at\r
- http://opensource.org/licenses/bsd-license.php.\r
-\r
- THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
- WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+ SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
\r
/**\r
Validate the IP6 option format for both the packets we received\r
and that we will transmit. It will compute the ICMPv6 error message fields\r
- if the option is malformated.\r
+ if the option is malformatted.\r
\r
@param[in] IpSb The IP6 service data.\r
@param[in] Packet The to be validated packet.\r
\r
\r
@retval TRUE The option is properly formatted.\r
- @retval FALSE The option is malformated.\r
+ @retval FALSE The option is malformatted.\r
\r
**/\r
BOOLEAN\r
@param[in] OptionLen The length of the whole option.\r
\r
@retval TRUE The option is properly formatted.\r
- @retval FALSE The option is malformated.\r
+ @retval FALSE The option is malformatted.\r
\r
**/\r
BOOLEAN\r
IN UINT16 OptionLen\r
)\r
{\r
- UINT16 Offset;\r
- UINT8 OptionType;\r
+ UINT32 Offset;\r
UINT16 Length;\r
+ IP6_OPTION_HEADER *OptionHeader;\r
+\r
+ if (Option == NULL) {\r
+ ASSERT (Option != NULL);\r
+ return FALSE;\r
+ }\r
\r
Offset = 0;\r
\r
- while (Offset < OptionLen) {\r
- OptionType = *(Option + Offset);\r
- Length = (UINT16) (*(Option + Offset + 1) * 8);\r
+ //\r
+ // RFC 4861 states that Neighbor Discovery packet can contain zero or more\r
+ // options. Start processing the options if at least Type + Length fields\r
+ // fit within the input buffer.\r
+ //\r
+ while (Offset + sizeof (IP6_OPTION_HEADER) - 1 < OptionLen) {\r
+ OptionHeader = (IP6_OPTION_HEADER*) (Option + Offset);\r
+ Length = (UINT16) OptionHeader->Length * 8;\r
\r
- switch (OptionType) {\r
+ switch (OptionHeader->Type) {\r
case Ip6OptionPrefixInfo:\r
if (Length != 32) {\r
return FALSE;\r
}\r
-\r
break;\r
\r
case Ip6OptionMtu:\r
if (Length != 8) {\r
return FALSE;\r
}\r
-\r
break;\r
\r
default:\r
- //\r
- // Check the length of Ip6OptionEtherSource, Ip6OptionEtherTarget, and\r
- // Ip6OptionRedirected here. For unrecognized options, silently ignore\r
- // and continue processsing the message.\r
- //\r
+ // RFC 4861 states that Length field cannot be 0.\r
if (Length == 0) {\r
return FALSE;\r
}\r
+ break;\r
+ }\r
+\r
+ //\r
+ // Check whether recognized options are within the input buffer's scope.\r
+ //\r
+ switch (OptionHeader->Type) {\r
+ case Ip6OptionEtherSource:\r
+ case Ip6OptionEtherTarget:\r
+ case Ip6OptionPrefixInfo:\r
+ case Ip6OptionRedirected:\r
+ case Ip6OptionMtu:\r
+ if (Offset + Length > (UINT32) OptionLen) {\r
+ return FALSE;\r
+ }\r
+ break;\r
\r
+ default:\r
+ //\r
+ // Unrecognized options can be either valid (but unused) or invalid\r
+ // (garbage in between or right after valid options). Silently ignore.\r
+ //\r
break;\r
}\r
\r
- Offset = (UINT16) (Offset + Length);\r
+ //\r
+ // Advance to the next option.\r
+ // Length already considers option header's Type + Length.\r
+ //\r
+ Offset += Length;\r
}\r
\r
return TRUE;\r
/**\r
Validate the IP6 extension header format for both the packets we received\r
and that we will transmit. It will compute the ICMPv6 error message fields\r
- if the option is mal-formated.\r
+ if the option is mal-formatted.\r
\r
@param[in] IpSb The IP6 service instance. This is an optional parameter.\r
@param[in] Packet The data of the packet. Ignored if NULL.\r
@param[out] Fragmented Indicate whether the packet is fragmented.\r
This is an optional parameter that may be NULL.\r
\r
- @retval TRUE The option is properly formated.\r
- @retval FALSE The option is malformated.\r
+ @retval TRUE The option is properly formatted.\r
+ @retval FALSE The option is malformatted.\r
\r
**/\r
BOOLEAN\r
\r
//\r
// RFC2460, ICMP Parameter Problem message with code 0 should be sent\r
- // if the length of a fragment is not a multiple of 8 octects and the M\r
+ // if the length of a fragment is not a multiple of 8 octets and the M\r
// flag of that fragment is 1, pointing to the Payload length field of the\r
// fragment packet.\r
//\r
@param[in] ExtHdrsLen The length of the extension headers.\r
@param[in] FragmentOffset The fragment offset of the data following the header.\r
@param[out] UpdatedExtHdrs The updated ExtHdrs with Fragment header inserted.\r
- It's caller's responsiblity to free this buffer.\r
+ It's caller's responsibility to free this buffer.\r
\r
@retval EFI_OUT_OF_RESOURCES Failed to finish the operation due to lake of\r
resource.\r