1. UsbMassStorage: Increase the timeout of USBFloppyRead10 and USBFloppyWrite10 for...

2. PxeBc: Fix array out bound error and add code to check the validation of the IP and subnet mask addresses.
3. DxeIpl: Make sure FV HOB is not corrupted by checking FV signature.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@2570 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/EdkModulePkg/Bus/Usb/UsbMassStorage/Dxe/UsbMassStorageData.h b/EdkModulePkg/Bus/Usb/UsbMassStorage/Dxe/UsbMassStorageData.h
index cef33bd4f51c060db2dc9787b8acc52da76be85d..56dbcd8e402bfba2ada032d3b213e248f9663f27 100644 (file)
--- a/EdkModulePkg/Bus/Usb/UsbMassStorage/Dxe/UsbMassStorageData.h
+++ b/EdkModulePkg/Bus/Usb/UsbMassStorage/Dxe/UsbMassStorageData.h
@@ -1,5 +1,5 @@
 /*++\r
-Copyright (c) 2006, Intel Corporation\r
+Copyright (c) 2006 - 2007, Intel Corporation\r
 All rights reserved. This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -30,9 +30,10 @@ Revision History
 //\r
 // timeout unit is in millisecond.\r
 //\r
-#define USBFLPTIMEOUT         1000\r
-#define STALL_1_MILLI_SECOND  1000\r
 \r
+#define STALL_1_MILLI_SECOND  1000\r
+#define USBFLPTIMEOUT         STALL_1_MILLI_SECOND\r
+#define USBDATATIMEOUT        2 * STALL_1_MILLI_SECOND\r
 //\r
 // ATAPI Packet Command\r
 //\r

diff --git a/EdkModulePkg/Bus/Usb/UsbMassStorage/Dxe/UsbMassStorageHelper.c b/EdkModulePkg/Bus/Usb/UsbMassStorage/Dxe/UsbMassStorageHelper.c
index eb7a8bb63a44373fce6505d2464135d3fea54f07..6483601b2bdc5fb4fd6d84f6402b063fd2f6b05f 100644 (file)
--- a/EdkModulePkg/Bus/Usb/UsbMassStorage/Dxe/UsbMassStorageHelper.c
+++ b/EdkModulePkg/Bus/Usb/UsbMassStorage/Dxe/UsbMassStorageHelper.c
@@ -1,6 +1,6 @@
 /*++\r
 \r
-Copyright (c) 2006, Intel Corporation\r
+Copyright (c) 2006 - 2007, Intel Corporation\r
 All rights reserved. This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -348,7 +348,7 @@ USBFloppyRead10 (
 \r
       ByteCount               = SectorCount * BlockSize;\r
 \r
-      TimeOut                 = (UINT16) (SectorCount * USBFLPTIMEOUT);\r
+      TimeOut                 = (UINT16) (SectorCount * USBDATATIMEOUT);\r
 \r
 \r
       Status = USBFloppyPacketCommand (\r
@@ -780,7 +780,7 @@ USBFloppyWrite10 (
 \r
       ByteCount               = SectorCount * BlockSize;\r
 \r
-      TimeOut                 = (UINT16) (SectorCount * USBFLPTIMEOUT);\r
+      TimeOut                 = (UINT16) (SectorCount * USBDATATIMEOUT);\r
 \r
       Status = USBFloppyPacketCommand (\r
                  UsbFloppyDevice,\r

diff --git a/EdkModulePkg/Core/DxeIplPeim/DxeLoad.c b/EdkModulePkg/Core/DxeIplPeim/DxeLoad.c
index cd38a03e5787af9b11b2cda3d019717728a5ec11..1133f6286074afa8d88cc1eaff040176316d0176 100644 (file)
--- a/EdkModulePkg/Core/DxeIplPeim/DxeLoad.c
+++ b/EdkModulePkg/Core/DxeIplPeim/DxeLoad.c
@@ -370,6 +370,11 @@ Returns:
   Hob.Raw = GetHobList ();\r
   while ((Hob.Raw = GetNextHob (EFI_HOB_TYPE_FV, Hob.Raw)) != NULL) {\r
     FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER *) (UINTN) (Hob.FirmwareVolume->BaseAddress);\r
+    //\r
+    // Make sure the FV HOB does not get corrupted.\r
+    //\r
+    ASSERT (FwVolHeader->Signature == EFI_FVH_SIGNATURE);\r
+\r
     Status = PeiServicesFfsFindNextFile (\r
                Type,\r
                FwVolHeader,\r

diff --git a/EdkModulePkg/Universal/Network/PxeBc/Dxe/bc.c b/EdkModulePkg/Universal/Network/PxeBc/Dxe/bc.c
index ec2099eb7a7bfd8bc9c08a16f982296021d27049..251690205a91873b879919f6b9a028d654dd0e6c 100644 (file)
--- a/EdkModulePkg/Universal/Network/PxeBc/Dxe/bc.c
+++ b/EdkModulePkg/Universal/Network/PxeBc/Dxe/bc.c
@@ -1950,11 +1950,14 @@ BcSetStationIP (
 --*/\r
 {\r
   EFI_PXE_BASE_CODE_MODE  *PxebcMode;\r
+  EFI_STATUS              StatCode;\r
   PXE_BASECODE_DEVICE     *Private;\r
+  UINT32                  SubnetMask;\r
 \r
   //\r
   // Lock the instance data and make sure started\r
   //\r
+  StatCode = EFI_SUCCESS;\r
 \r
   if (This == NULL) {\r
     DEBUG ((EFI_D_ERROR, "BC *This pointer == NULL"));\r
@@ -1972,26 +1975,61 @@ BcSetStationIP (
 \r
   if (This->Mode == NULL || !This->Mode->Started) {\r
     DEBUG ((EFI_D_ERROR, "BC was not started."));\r
-    EfiReleaseLock (&Private->Lock);\r
-    return EFI_NOT_STARTED;\r
+    StatCode = EFI_NOT_STARTED;\r
+    goto RELEASE_LOCK;\r
   }\r
 \r
   PxebcMode = Private->EfiBc.Mode;\r
 \r
-  if (StationIpPtr != NULL) {\r
-    CopyMem (&PxebcMode->StationIp, StationIpPtr, sizeof (EFI_IP_ADDRESS));\r
-    Private->GoodStationIp = TRUE;\r
+  if (!Private->GoodStationIp && ((StationIpPtr == NULL) || (SubnetMaskPtr == NULL))) {\r
+    //\r
+    // It's not allowed to only set one of the two addresses while there isn't a previous\r
+    // GOOD address configuration.\r
+    //\r
+    StatCode = EFI_INVALID_PARAMETER;\r
+    goto RELEASE_LOCK;\r
   }\r
 \r
   if (SubnetMaskPtr != NULL) {\r
-    CopyMem (&PxebcMode->SubnetMask, SubnetMaskPtr, sizeof (EFI_IP_ADDRESS));\r
+    SubnetMask = SubnetMaskPtr->Addr[0];\r
+\r
+    if (SubnetMask & (SubnetMask + 1)) {\r
+      //\r
+      // the subnet mask is valid if it's with leading continuous 1 bits.\r
+      //\r
+      StatCode = EFI_INVALID_PARAMETER;\r
+      goto RELEASE_LOCK;\r
+    }\r
+  } else {\r
+    SubnetMaskPtr = &PxebcMode->SubnetMask;\r
+    SubnetMask    = SubnetMaskPtr->Addr[0];\r
   }\r
+\r
+  if (StationIpPtr == NULL) {\r
+    StationIpPtr = &PxebcMode->StationIp;\r
+  }\r
+\r
+  if (!IS_INADDR_UNICAST (StationIpPtr) || \r
+      ((StationIpPtr->Addr[0] | SubnetMask) == BROADCAST_IPv4)) {\r
+    //\r
+    // The station IP is not a unicast address.\r
+    //\r
+    StatCode = EFI_INVALID_PARAMETER;\r
+    goto RELEASE_LOCK;\r
+  }\r
+\r
+  CopyMem (&PxebcMode->StationIp, StationIpPtr, sizeof (EFI_IP_ADDRESS));\r
+  CopyMem (&PxebcMode->SubnetMask, SubnetMaskPtr, sizeof (EFI_IP_ADDRESS));\r
+\r
+  Private->GoodStationIp = TRUE;\r
+\r
+RELEASE_LOCK:\r
   //\r
   // Unlock the instance data\r
   //\r
   EfiReleaseLock (&Private->Lock);\r
 \r
-  return EFI_SUCCESS;\r
+  return StatCode;\r
 }\r
 \r
 EFI_DRIVER_BINDING_PROTOCOL gPxeBcDriverBinding = {\r

diff --git a/EdkModulePkg/Universal/Network/PxeBc/Dxe/pxe_loadfile.c b/EdkModulePkg/Universal/Network/PxeBc/Dxe/pxe_loadfile.c
index 3dceefb945cd275fd688743365c045cb7ca349a3..85bb8bb2bf5ec1733fd0eb92d011c36c215aeb58 100644 (file)
--- a/EdkModulePkg/Universal/Network/PxeBc/Dxe/pxe_loadfile.c
+++ b/EdkModulePkg/Universal/Network/PxeBc/Dxe/pxe_loadfile.c
@@ -571,7 +571,7 @@ Returns:
   //\r
   // build menu items array\r
   //\r
-  for (Longest = NumMenuItems = Index = 0; Index < MenuLth && NumMenuItems <= MAX_MENULIST;) {\r
+  for (Longest = NumMenuItems = Index = 0; Index < MenuLth && NumMenuItems < MAX_MENULIST;) {\r
     UINTN lth;\r
 \r
     lth = Ptr.CurrentMenuItemPtr->DataLen + sizeof (*Ptr.CurrentMenuItemPtr) - sizeof (Ptr.CurrentMenuItemPtr->Data);\r