NetworkPkg/TlsDxe: verify DataSize for EfiTlsCipherList

[mirror_edk2.git] / NetworkPkg / TlsDxe / TlsProtocol.c

diff --git a/NetworkPkg/TlsDxe/TlsProtocol.c b/NetworkPkg/TlsDxe/TlsProtocol.c
index ad4c922c60bd2ea5300d0084a19460da56d58c0d..a5f95a09834516e9ca7f90e0726216c3f22c2f25 100644 (file)
--- a/NetworkPkg/TlsDxe/TlsProtocol.c
+++ b/NetworkPkg/TlsDxe/TlsProtocol.c
@@ -38,6 +38,7 @@ EFI_TLS_PROTOCOL  mTlsProtocol = {
                                   This is NULL.\r
                                   Data is NULL.\r
                                   DataSize is 0.\r
+                                  DataSize is invalid for DataType.\r
   @retval EFI_UNSUPPORTED         The DataType is unsupported.\r
   @retval EFI_ACCESS_DENIED       If the DataType is one of below:\r
                                   EfiTlsClientRandom\r
@@ -59,6 +60,7 @@ TlsSetSessionData (
   EFI_STATUS                Status;\r
   TLS_INSTANCE              *Instance;\r
   UINT16                    *CipherId;\r
+  UINTN                     CipherCount;\r
   UINTN                     Index;\r
 \r
   EFI_TPL                   OldTpl;\r
@@ -100,17 +102,23 @@ TlsSetSessionData (
     Status = TlsSetConnectionEnd (Instance->TlsConn, *((EFI_TLS_CONNECTION_END *) Data));\r
     break;\r
   case EfiTlsCipherList:\r
+    if (DataSize % sizeof (EFI_TLS_CIPHER) != 0) {\r
+      Status = EFI_INVALID_PARAMETER;\r
+      goto ON_EXIT;\r
+    }\r
+\r
     CipherId = AllocatePool (DataSize);\r
     if (CipherId == NULL) {\r
       Status = EFI_OUT_OF_RESOURCES;\r
       goto ON_EXIT;\r
     }\r
 \r
-    for (Index = 0; Index < DataSize / sizeof (EFI_TLS_CIPHER); Index++) {\r
+    CipherCount = DataSize / sizeof (EFI_TLS_CIPHER);\r
+    for (Index = 0; Index < CipherCount; Index++) {\r
       *(CipherId +Index) = HTONS (*(((UINT16 *) Data) + Index));\r
     }\r
 \r
-    Status = TlsSetCipherList (Instance->TlsConn, CipherId, DataSize / sizeof (EFI_TLS_CIPHER));\r
+    Status = TlsSetCipherList (Instance->TlsConn, CipherId, CipherCount);\r
 \r
     FreePool (CipherId);\r
     break;\r