NetworkPkg/TcpDxe: Check TCP payload for release version.

[mirror_edk2.git] / NetworkPkg / TcpDxe / TcpInput.c

diff --git a/NetworkPkg/TcpDxe/TcpInput.c b/NetworkPkg/TcpDxe/TcpInput.c
index f8845dca470e97732482077ef6770b78533347df..92a0ab8c35148b75921d6995d7d8f0bb197550c2 100644 (file)
--- a/NetworkPkg/TcpDxe/TcpInput.c
+++ b/NetworkPkg/TcpDxe/TcpInput.c
@@ -281,8 +281,11 @@ TcpComputeRtt (
   @param[in]  Left     The sequence number of the window's left edge.\r
   @param[in]  Right    The sequence number of the window's right edge.\r
 \r
+  @retval     0        The segment is broken.\r
+  @retval     1        The segment is in good shape.\r
+\r
 **/\r
-VOID\r
+INTN\r
 TcpTrimSegment (\r
   IN NET_BUF   *Nbuf,\r
   IN TCP_SEQNO Left,\r
@@ -306,7 +309,7 @@ TcpTrimSegment (
 \r
     Seg->Seq = Seg->End;\r
     NetbufTrim (Nbuf, Nbuf->TotalSize, NET_BUF_HEAD);\r
-    return;\r
+    return 1;\r
   }\r
 \r
   //\r
@@ -359,7 +362,7 @@ TcpTrimSegment (
     }\r
   }\r
 \r
-  ASSERT (TcpVerifySegment (Nbuf) != 0);\r
+  return TcpVerifySegment (Nbuf);\r
 }\r
 \r
 /**\r
@@ -368,14 +371,17 @@ TcpTrimSegment (
   @param[in]  Tcb      Pointer to the TCP_CB of this TCP instance.\r
   @param[in]  Nbuf     Pointer to the NET_BUF containing the received tcp segment.\r
 \r
+  @retval     0        The segment is broken.\r
+  @retval     1        The segment is in good shape.\r
+\r
 **/\r
-VOID\r
+INTN\r
 TcpTrimInWnd (\r
   IN TCP_CB  *Tcb,\r
   IN NET_BUF *Nbuf\r
   )\r
 {\r
-  TcpTrimSegment (Nbuf, Tcb->RcvNxt, Tcb->RcvWl2 + Tcb->RcvWnd);\r
+  return TcpTrimSegment (Nbuf, Tcb->RcvNxt, Tcb->RcvWl2 + Tcb->RcvWnd);\r
 }\r
 \r
 /**\r
@@ -421,7 +427,16 @@ TcpDeliverData (
     Nbuf  = NET_LIST_USER_STRUCT (Entry, NET_BUF, List);\r
     Seg   = TCPSEG_NETBUF (Nbuf);\r
 \r
-    ASSERT (TcpVerifySegment (Nbuf) != 0);\r
+    if (TcpVerifySegment (Nbuf) == 0) {\r
+      DEBUG (\r
+        (EFI_D_ERROR,\r
+        "TcpToSendData: discard a broken segment for TCB %p\n",\r
+        Tcb)\r
+        );\r
+      NetbufFree (Nbuf);\r
+      return -1;\r
+    }\r
+    \r
     ASSERT (Nbuf->Tcp == NULL);\r
 \r
     if (TCP_SEQ_GT (Seg->Seq, Seq)) {\r
@@ -561,8 +576,11 @@ TcpDeliverData (
   @param[in, out]  Tcb   Pointer to the TCP_CB of this TCP instance.\r
   @param[in]       Nbuf  Pointer to the buffer containing the data to be queued.\r
 \r
+  @retval          0     An error condition occurred.\r
+  @retval          1     No error occurred to queue data.\r
+\r
 **/\r
-VOID\r
+INTN\r
 TcpQueueData (\r
   IN OUT TCP_CB  *Tcb,\r
   IN     NET_BUF *Nbuf\r
@@ -588,7 +606,7 @@ TcpQueueData (
   if (IsListEmpty (Head)) {\r
 \r
     InsertTailList (Head, &Nbuf->List);\r
-    return;\r
+    return 1;\r
   }\r
 \r
   //\r
@@ -615,12 +633,12 @@ TcpQueueData (
     if (TCP_SEQ_LT (Seg->Seq, TCPSEG_NETBUF (Node)->End)) {\r
 \r
       if (TCP_SEQ_LEQ (Seg->End, TCPSEG_NETBUF (Node)->End)) {\r
-\r
-        NetbufFree (Nbuf);\r
-        return;\r
+        return 1;\r
       }\r
 \r
-      TcpTrimSegment (Nbuf, TCPSEG_NETBUF (Node)->End, Seg->End);\r
+      if (TcpTrimSegment (Nbuf, TCPSEG_NETBUF (Node)->End, Seg->End) == 0) {\r
+        return 0;\r
+      }\r
     }\r
   }\r
 \r
@@ -648,16 +666,20 @@ TcpQueueData (
       if (TCP_SEQ_LEQ (TCPSEG_NETBUF (Node)->Seq, Seg->Seq)) {\r
 \r
         RemoveEntryList (&Nbuf->List);\r
-        NetbufFree (Nbuf);\r
-        return;\r
+        return 1;\r
       }\r
 \r
-      TcpTrimSegment (Nbuf, Seg->Seq, TCPSEG_NETBUF (Node)->Seq);\r
+      if (TcpTrimSegment (Nbuf, Seg->Seq, TCPSEG_NETBUF (Node)->Seq) == 0) {\r
+        RemoveEntryList (&Nbuf->List);\r
+        return 0;\r
+      }\r
       break;\r
     }\r
 \r
     Cur = Cur->ForwardLink;\r
   }\r
+\r
+  return 1;\r
 }\r
 \r
 \r
@@ -667,8 +689,11 @@ TcpQueueData (
   @param[in]  Tcb      Pointer to the TCP_CB of this TCP instance.\r
   @param[in]  Ack      The acknowledge seuqence number of the received segment.\r
 \r
+  @retval          0     An error condition occurred.\r
+  @retval          1     No error occurred.\r
+\r
 **/\r
-VOID\r
+INTN\r
 TcpAdjustSndQue (\r
   IN TCP_CB    *Tcb,\r
   IN TCP_SEQNO Ack\r
@@ -701,9 +726,10 @@ TcpAdjustSndQue (
       continue;\r
     }\r
 \r
-    TcpTrimSegment (Node, Ack, Seg->End);\r
-    break;\r
+    return TcpTrimSegment (Node, Ack, Seg->End);\r
   }\r
+\r
+  return 1;\r
 }\r
 \r
 /**\r
@@ -893,7 +919,15 @@ TcpInput (
 \r
       TcpSetState (Tcb, TCP_SYN_RCVD);\r
       TcpSetTimer (Tcb, TCP_TIMER_CONNECT, Tcb->ConnectTimeout);\r
-      TcpTrimInWnd (Tcb, Nbuf);\r
+      if (TcpTrimInWnd (Tcb, Nbuf) == 0) {\r
+        DEBUG (\r
+          (EFI_D_ERROR,\r
+          "TcpInput: discard a broken segment for TCB %p\n",\r
+          Tcb)\r
+          );\r
+\r
+        goto DISCARD;\r
+      }\r
 \r
       goto StepSix;\r
     }\r
@@ -975,7 +1009,15 @@ TcpInput (
           TCP_CLEAR_FLG (Tcb->CtrlFlag, TCP_CTRL_RTT_ON);\r
         }\r
 \r
-        TcpTrimInWnd (Tcb, Nbuf);\r
+        if (TcpTrimInWnd (Tcb, Nbuf) == 0) {\r
+          DEBUG (\r
+            (EFI_D_ERROR,\r
+            "TcpInput: discard a broken segment for TCB %p\n",\r
+            Tcb)\r
+            );\r
+\r
+          goto DISCARD;\r
+        }\r
 \r
         TCP_SET_FLG (Tcb->CtrlFlag, TCP_CTRL_ACK_NOW);\r
 \r
@@ -993,9 +1035,16 @@ TcpInput (
         TcpSetState (Tcb, TCP_SYN_RCVD);\r
 \r
         ASSERT (Tcb->SndNxt == Tcb->Iss + 1);\r
-        TcpAdjustSndQue (Tcb, Tcb->SndNxt);\r
 \r
-        TcpTrimInWnd (Tcb, Nbuf);\r
+        if (TcpAdjustSndQue (Tcb, Tcb->SndNxt) == 0 || TcpTrimInWnd (Tcb, Nbuf) == 0) {\r
+          DEBUG (\r
+            (EFI_D_ERROR,\r
+            "TcpInput: discard a broken segment for TCB %p\n",\r
+            Tcb)\r
+            );\r
+\r
+          goto DISCARD;\r
+        }\r
 \r
         DEBUG (\r
           (EFI_D_WARN,\r
@@ -1081,7 +1130,15 @@ TcpInput (
   //\r
   // Trim the data and flags.\r
   //\r
-  TcpTrimInWnd (Tcb, Nbuf);\r
+  if (TcpTrimInWnd (Tcb, Nbuf) == 0) {\r
+    DEBUG (\r
+      (EFI_D_ERROR,\r
+      "TcpInput: discard a broken segment for TCB %p\n",\r
+      Tcb)\r
+      );\r
+\r
+    goto DISCARD;\r
+  }\r
 \r
   //\r
   // Third step: Check security and precedence, Ignored\r
@@ -1256,7 +1313,16 @@ TcpInput (
 \r
   if (TCP_SEQ_GT (Seg->Ack, Tcb->SndUna)) {\r
 \r
-    TcpAdjustSndQue (Tcb, Seg->Ack);\r
+    if (TcpAdjustSndQue (Tcb, Seg->Ack) == 0) {\r
+      DEBUG (\r
+        (EFI_D_ERROR,\r
+        "TcpInput: discard a broken segment for TCB %p\n",\r
+        Tcb)\r
+        );\r
+\r
+      goto DISCARD;\r
+    }\r
+    \r
     Tcb->SndUna = Seg->Ack;\r
 \r
     if (TCP_FLG_ON (Tcb->CtrlFlag, TCP_CTRL_SND_URG) &&\r
@@ -1489,7 +1555,16 @@ StepSix:
       goto RESET_THEN_DROP;\r
     }\r
 \r
-    TcpQueueData (Tcb, Nbuf);\r
+    if (TcpQueueData (Tcb, Nbuf) == 0) {\r
+      DEBUG (\r
+        (EFI_D_ERROR,\r
+        "TcpInput: discard a broken segment for TCB %p\n",\r
+        Tcb)\r
+        );\r
+\r
+      goto DISCARD;\r
+    }\r
+    \r
     if (TcpDeliverData (Tcb) == -1) {\r
       goto RESET_THEN_DROP;\r
     }\r