MdeModulePkg: Check for the max DHCP packet length before use it.

This patch updates the PXE driver to drop the input DHCP packet if it
exceed the maximum length.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-By: Wu Jiaxin <jiaxin.wu@intel.com>

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
index eac955cd711cc5a647fb3c8bd34624c7bad40b88..f03176b7cae07e3482b46443debe33ce63a78bf5 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
@@ -912,6 +912,14 @@ PxeBcDhcpCallBack (
 \r
   case Dhcp4SendDiscover:\r
   case Dhcp4SendRequest:\r
+    if (Packet->Length > PXEBC_DHCP4_MAX_PACKET_SIZE) {\r
+      //\r
+      // If the to be sent packet exceeds the maximum length, abort the DHCP process.\r
+      //\r
+      Status = EFI_ABORTED;\r
+      break;\r
+    }\r
+    \r
     if (Mode->SendGUID) {\r
       //\r
       // send the system GUID instead of the MAC address as the hardware address\r
@@ -942,6 +950,13 @@ PxeBcDhcpCallBack (
 \r
   case Dhcp4RcvdOffer:\r
     Status = EFI_NOT_READY;\r
+    if (Packet->Length > PXEBC_DHCP4_MAX_PACKET_SIZE) {\r
+      //\r
+      // Ignore the incoming Offers which exceed the maximum length.\r
+      //\r
+      break;\r
+    }\r
+    \r
     if (Private->NumOffers < PXEBC_MAX_OFFER_NUM) {\r
       //\r
       // Cache the dhcp offers in Private->Dhcp4Offers[]\r
@@ -967,6 +982,14 @@ PxeBcDhcpCallBack (
     break;\r
 \r
   case Dhcp4RcvdAck:\r
+    if (Packet->Length > PXEBC_DHCP4_MAX_PACKET_SIZE) {\r
+      //\r
+      // Abort the DHCP if the ACK packet exceeds the maximum length.\r
+      //\r
+         Status = EFI_ABORTED;\r
+      break;\r
+    }\r
+\r
     //\r
     // Cache Ack\r
     //\r

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.h
index abdf05d3a5aee2187696ecf9f6f677776313f681..614ea75e759b0194a682dc787d22bb5ac6cc8965 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.h
@@ -18,7 +18,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 #define PXEBC_DHCP4_MAX_OPTION_NUM         16\r
 #define PXEBC_DHCP4_MAX_OPTION_SIZE        312\r
-#define PXEBC_DHCP4_MAX_PACKET_SIZE        1472\r
+#define PXEBC_DHCP4_MAX_PACKET_SIZE        (sizeof (EFI_PXE_BASE_CODE_PACKET))\r
 \r
 #define PXEBC_DHCP4_S_PORT                 67\r
 #define PXEBC_DHCP4_C_PORT                 68\r