NetworkPkg: Check received packet size before use it.

[mirror_edk2.git] / NetworkPkg / Udp6Dxe / Udp6Impl.c

diff --git a/NetworkPkg/Udp6Dxe/Udp6Impl.c b/NetworkPkg/Udp6Dxe/Udp6Impl.c
index 40e3aff0695fed6a16c6af3abcda7c42ec58b7f0..7ed50411c66b5bff32865117b3c6196598377e68 100644 (file)
--- a/NetworkPkg/Udp6Dxe/Udp6Impl.c
+++ b/NetworkPkg/Udp6Dxe/Udp6Impl.c
@@ -1,7 +1,7 @@
 /** @file\r
   Udp6 driver's whole implementation.\r
 \r
-  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2009 - 2016 Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -1598,6 +1598,11 @@ Udp6Demultiplex (
   EFI_UDP6_SESSION_DATA  *Udp6Session;\r
   UINTN                  Enqueued;\r
 \r
+  if (Packet->TotalSize < sizeof (EFI_UDP_HEADER)) {\r
+    NetbufFree (Packet);\r
+    return;\r
+  }\r
+  \r
   //\r
   // Get the datagram header from the packet buffer.\r
   //\r
@@ -1619,6 +1624,7 @@ Udp6Demultiplex (
       //\r
       // Wrong checksum.\r
       //\r
+      NetbufFree (Packet);\r
       return;\r
     }\r
   }\r
@@ -1834,6 +1840,11 @@ Udp6IcmpHandler (
   LIST_ENTRY             *Entry;\r
   UDP6_INSTANCE_DATA     *Instance;\r
 \r
+  if (Packet->TotalSize < sizeof (EFI_UDP_HEADER)) {\r
+    NetbufFree (Packet);\r
+    return;\r
+  }\r
+  \r
   Udp6Header = (EFI_UDP_HEADER *) NetbufGetByte (Packet, 0, NULL);\r
   ASSERT (Udp6Header != NULL);\r
 \r