MdeModulePkg: Check received packet size before use it.

Arbitrary length of packet may be received from network, including the
packets with zero payload data or malformed protocol header. So the code
much check the actually received data size before using it. For example, in
current edk2 network stack, an zero payload UDP packet may cause the
platform ASSERT in NetbufFromExt() because of the zero fragment number.
This patch update the IpIoLib and UdpIoLib to check and discard the zero
payload data packet to avoid above assert. Some other network drivers are
also updated to check the packet size to guarantee the minimum length of
protocol header is received from upper layer driver.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Sriram Subramanian <sriram-s@hpe.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>

diff --git a/MdeModulePkg/Library/DxeIpIoLib/DxeIpIoLib.c b/MdeModulePkg/Library/DxeIpIoLib/DxeIpIoLib.c
index cc93c2b89c01aaade9d1ef822348231d710acb18..ab4df80768dc5ef6433da7bf8c35d3d849aca5ac 100644 (file)
--- a/MdeModulePkg/Library/DxeIpIoLib/DxeIpIoLib.c
+++ b/MdeModulePkg/Library/DxeIpIoLib/DxeIpIoLib.c
@@ -2,7 +2,7 @@
   IpIo Library.\r
 \r
 (C) Copyright 2014 Hewlett-Packard Development Company, L.P.<BR>\r
-Copyright (c) 2005 - 2009, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2005 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -1029,42 +1029,56 @@ IpIoListenHandlerDpc (
 \r
   if (IpIo->IpVersion == IP_VERSION_4) {\r
     if ((EFI_IP4 (RxData->Ip4RxData.Header->SourceAddress) != 0) &&\r
-      !NetIp4IsUnicast (EFI_NTOHL (((EFI_IP4_RECEIVE_DATA *) RxData)->Header->SourceAddress), 0)) {\r
+        !NetIp4IsUnicast (EFI_NTOHL (((EFI_IP4_RECEIVE_DATA *) RxData)->Header->SourceAddress), 0)) {\r
+      //\r
+      // The source address is not zero and it's not a unicast IP address, discard it.\r
+      //\r
+      goto CleanUp;\r
+    }\r
+\r
+    if (RxData->Ip4RxData.DataLength == 0) {\r
+      //\r
+      // Discard zero length data payload packet.\r
+      //\r
+      goto CleanUp;\r
+    }\r
+\r
     //\r
-    // The source address is not zero and it's not a unicast IP address, discard it.\r
+    // Create a netbuffer representing IPv4 packet\r
     //\r
-    goto CleanUp;\r
-  }\r
-\r
-  //\r
-  // Create a netbuffer representing IPv4 packet\r
-  //\r
-  Pkt = NetbufFromExt (\r
-          (NET_FRAGMENT *) RxData->Ip4RxData.FragmentTable,\r
-          RxData->Ip4RxData.FragmentCount,\r
-          0,\r
-          0,\r
-          IpIoExtFree,\r
-          RxData->Ip4RxData.RecycleSignal\r
-          );\r
-  if (NULL == Pkt) {\r
-    goto CleanUp;\r
-  }\r
+    Pkt = NetbufFromExt (\r
+            (NET_FRAGMENT *) RxData->Ip4RxData.FragmentTable,\r
+            RxData->Ip4RxData.FragmentCount,\r
+            0,\r
+            0,\r
+            IpIoExtFree,\r
+            RxData->Ip4RxData.RecycleSignal\r
+            );\r
+    if (NULL == Pkt) {\r
+      goto CleanUp;\r
+    }\r
 \r
-  //\r
-  // Create a net session\r
-  //\r
-  Session.Source.Addr[0] = EFI_IP4 (RxData->Ip4RxData.Header->SourceAddress);\r
-  Session.Dest.Addr[0]   = EFI_IP4 (RxData->Ip4RxData.Header->DestinationAddress);\r
-  Session.IpHdr.Ip4Hdr   = RxData->Ip4RxData.Header;\r
-  Session.IpHdrLen       = RxData->Ip4RxData.HeaderLength;\r
-  Session.IpVersion      = IP_VERSION_4;\r
+    //\r
+    // Create a net session\r
+    //\r
+    Session.Source.Addr[0] = EFI_IP4 (RxData->Ip4RxData.Header->SourceAddress);\r
+    Session.Dest.Addr[0]   = EFI_IP4 (RxData->Ip4RxData.Header->DestinationAddress);\r
+    Session.IpHdr.Ip4Hdr   = RxData->Ip4RxData.Header;\r
+    Session.IpHdrLen       = RxData->Ip4RxData.HeaderLength;\r
+    Session.IpVersion      = IP_VERSION_4;\r
   } else {\r
 \r
     if (!NetIp6IsValidUnicast(&RxData->Ip6RxData.Header->SourceAddress)) {\r
       goto CleanUp;\r
     }\r
     \r
+    if (RxData->Ip6RxData.DataLength == 0) {\r
+      //\r
+      // Discard zero length data payload packet.\r
+      //\r
+      goto CleanUp;\r
+    }\r
+    \r
     //\r
     // Create a netbuffer representing IPv6 packet\r
     //\r
@@ -1279,6 +1293,14 @@ IpIoOpen (
   // configure ip\r
   //\r
   if (IpVersion == IP_VERSION_4){\r
+    //\r
+    // RawData mode is no supported.\r
+    //\r
+    ASSERT (!OpenData->IpConfigData.Ip4CfgData.RawData);\r
+    if (OpenData->IpConfigData.Ip4CfgData.RawData) {\r
+      return EFI_UNSUPPORTED;\r
+    }\r
+    \r
     Status = IpIo->Ip.Ip4->Configure (\r
                              IpIo->Ip.Ip4,\r
                              &OpenData->IpConfigData.Ip4CfgData\r

diff --git a/MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c b/MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c
index e1d72f3f1c68929721a7ce4a56b918951ffc9f11..4f7126d3ce56e8514764e296e0981f22d2a4c904 100644 (file)
--- a/MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c
+++ b/MdeModulePkg/Library/DxeUdpIoLib/DxeUdpIoLib.c
@@ -1,7 +1,7 @@
 /** @file\r
   Help functions to access UDP service, it is used by both the DHCP and MTFTP.\r
 \r
-Copyright (c) 2005 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2005 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at<BR>\r
@@ -215,6 +215,12 @@ UdpIoOnDgramRcvdDpc (
   // Build a NET_BUF from the UDP receive data, then deliver it up.\r
   //\r
   if (RxToken->UdpIo->UdpVersion == UDP_IO_UDP4_VERSION) {\r
+    if (((EFI_UDP4_RECEIVE_DATA *) RxData)->DataLength == 0) {\r
+      //\r
+      // Discard zero length data payload packet.\r
+      //\r
+      goto Resume;\r
+    }\r
 \r
     Netbuf = NetbufFromExt (\r
                (NET_FRAGMENT *)((EFI_UDP4_RECEIVE_DATA *) RxData)->FragmentTable,\r
@@ -252,6 +258,12 @@ UdpIoOnDgramRcvdDpc (
     EndPoint.LocalAddr.Addr[0]  = NTOHL (EndPoint.LocalAddr.Addr[0]);\r
     EndPoint.RemoteAddr.Addr[0] = NTOHL (EndPoint.RemoteAddr.Addr[0]);\r
   } else {\r
+    if (((EFI_UDP6_RECEIVE_DATA *) RxData)->DataLength == 0) {\r
+      //\r
+      // Discard zero length data payload packet.\r
+      //\r
+      goto Resume;\r
+    }\r
 \r
     Netbuf = NetbufFromExt (\r
                (NET_FRAGMENT *)((EFI_UDP6_RECEIVE_DATA *) RxData)->FragmentTable,\r
@@ -291,6 +303,15 @@ UdpIoOnDgramRcvdDpc (
   }\r
 \r
   RxToken->CallBack (Netbuf, &EndPoint, EFI_SUCCESS, RxToken->Context);\r
+\r
+Resume:\r
+  if (RxToken->UdpIo->UdpVersion == UDP_IO_UDP4_VERSION) {\r
+    gBS->SignalEvent (((EFI_UDP4_RECEIVE_DATA *) RxData)->RecycleSignal);\r
+    RxToken->UdpIo->Protocol.Udp4->Receive (RxToken->UdpIo->Protocol.Udp4, &RxToken->Token.Udp4);\r
+  } else {\r
+    gBS->SignalEvent (((EFI_UDP6_RECEIVE_DATA *) RxData)->RecycleSignal);\r
+    RxToken->UdpIo->Protocol.Udp6->Receive (RxToken->UdpIo->Protocol.Udp6, &RxToken->Token.Udp6);\r
+  }\r
 }\r
 \r
 /**\r

diff --git a/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c b/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
index 633c3e7d387e62b7f55b14f083cbbc7fb853cddd..afe49298781d181d62af7ba9c9b47fe3de752c74 100644 (file)
--- a/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
+++ b/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
@@ -1,7 +1,7 @@
 /** @file\r
   The implementation of the ARP protocol.\r
   \r
-Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at<BR>\r
@@ -112,15 +112,28 @@ ArpOnFrameRcvdDpc (
   // Status is EFI_SUCCESS, process the received frame.\r
   //\r
   RxData = RxToken->Packet.RxData;\r
-  Head   = (ARP_HEAD *) RxData->PacketData;\r
+  //\r
+  // Sanity check.\r
+  //\r
+  if (RxData->DataLength < sizeof (ARP_HEAD)) {\r
+    //\r
+    // Restart the receiving if packet size is not correct.\r
+    //\r
+    goto RESTART_RECEIVE;\r
+  }\r
 \r
   //\r
   // Convert the byte order of the multi-byte fields.\r
   //\r
+  Head   = (ARP_HEAD *) RxData->PacketData;\r
   Head->HwType    = NTOHS (Head->HwType);\r
   Head->ProtoType = NTOHS (Head->ProtoType);\r
   Head->OpCode    = NTOHS (Head->OpCode);\r
 \r
+  if (RxData->DataLength < (sizeof (ARP_HEAD) + 2 * Head->HwAddrLen + 2 * Head->ProtoAddrLen)) {\r
+    goto RESTART_RECEIVE;\r
+  }\r
+\r
   if ((Head->HwType != ArpService->SnpMode.IfType) ||\r
     (Head->HwAddrLen != ArpService->SnpMode.HwAddressSize) ||\r
     (RxData->ProtocolType != ARP_ETHER_PROTO_TYPE)) {\r

diff --git a/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c b/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c
index 209127d18f7ea49c895b15aaff770fb2ad8ebccd..11936ad7f14e880c4f12e01f0ae95e9774e10bc8 100644 (file)
--- a/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c
+++ b/MdeModulePkg/Universal/Network/Tcp4Dxe/Tcp4Input.c
@@ -1,7 +1,7 @@
 /** @file\r
   TCP input process routines.\r
 \r
-Copyright (c) 2005 - 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2005 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -711,12 +711,18 @@ TcpInput (
 \r
   Head    = (TCP_HEAD *) NetbufGetByte (Nbuf, 0, NULL);\r
   ASSERT (Head != NULL);\r
+\r
+  if (Nbuf->TotalSize < sizeof (TCP_HEAD)) {\r
+    DEBUG ((EFI_D_INFO, "TcpInput: received a malformed packet\n"));\r
+    goto DISCARD;\r
+  }\r
+  \r
   Len     = Nbuf->TotalSize - (Head->HeadLen << 2);\r
 \r
   if ((Head->HeadLen < 5) || (Len < 0) ||\r
       (TcpChecksum (Nbuf, NetPseudoHeadChecksum (Src, Dst, 6, 0)) != 0)) {\r
 \r
-    DEBUG ((EFI_D_INFO, "TcpInput: received an mal-formated packet\n"));\r
+    DEBUG ((EFI_D_INFO, "TcpInput: received a malformed packet\n"));\r
     goto DISCARD;\r
   }\r
 \r
@@ -1423,6 +1429,10 @@ TcpIcmpInput (
   BOOLEAN          IcmpErrIsHard;\r
   BOOLEAN          IcmpErrNotify;\r
 \r
+  if (Nbuf->TotalSize < sizeof (TCP_HEAD)) {\r
+    goto CLEAN_EXIT;\r
+  }\r
+\r
   Head = (TCP_HEAD *) NetbufGetByte (Nbuf, 0, NULL);\r
   ASSERT (Head != NULL);\r
   Tcb = TcpLocateTcb (\r

diff --git a/MdeModulePkg/Universal/Network/Udp4Dxe/Udp4Impl.c b/MdeModulePkg/Universal/Network/Udp4Dxe/Udp4Impl.c
index 4f077d6b968036f0046eb0cc27c3a5f56b48443f..df95077aac9ead1c40614a0b427fc0ec69d3f0c4 100644 (file)
--- a/MdeModulePkg/Universal/Network/Udp4Dxe/Udp4Impl.c
+++ b/MdeModulePkg/Universal/Network/Udp4Dxe/Udp4Impl.c
@@ -1,7 +1,7 @@
 /** @file\r
   The implementation of the Udp4 protocol.\r
   \r
-Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2016 Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -1608,6 +1608,11 @@ Udp4Demultiplex (
   EFI_UDP4_SESSION_DATA  *Udp4Session;\r
   UINTN                  Enqueued;\r
 \r
+  if (Packet->TotalSize < sizeof (EFI_UDP_HEADER)) {\r
+    NetbufFree (Packet);\r
+    return;\r
+  }\r
+\r
   //\r
   // Get the datagram header from the packet buffer.\r
   //\r
@@ -1629,6 +1634,7 @@ Udp4Demultiplex (
       //\r
       // Wrong checksum.\r
       //\r
+      NetbufFree (Packet);\r
       return;\r
     }\r
   }\r
@@ -1797,6 +1803,11 @@ Udp4IcmpHandler (
   LIST_ENTRY             *Entry;\r
   UDP4_INSTANCE_DATA     *Instance;\r
 \r
+  if (Packet->TotalSize < sizeof (EFI_UDP_HEADER)) {\r
+    NetbufFree (Packet);\r
+    return;\r
+  }\r
+  \r
   Udp4Header = (EFI_UDP_HEADER *) NetbufGetByte (Packet, 0, NULL);\r
   ASSERT (Udp4Header != NULL);\r
 \r