NetworkPkg/Ip4Dxe: Check the received package length (CVE-2019-14559).

v3: correct the coding style.
v2: correct the commit message & add BZ number.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1610

This patch is to check the received package length to make sure the package
has a valid length field.

Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>

diff --git a/NetworkPkg/Ip4Dxe/Ip4Input.c b/NetworkPkg/Ip4Dxe/Ip4Input.c
index fec242c71f4f7225db02df090eafa680c951cdaa..868f04812c8bb238ee0a6f40fc911648ab03919d 100644 (file)
--- a/NetworkPkg/Ip4Dxe/Ip4Input.c
+++ b/NetworkPkg/Ip4Dxe/Ip4Input.c
@@ -1,7 +1,7 @@
 /** @file\r
   IP4 input process.\r
 \r
-Copyright (c) 2005 - 2018, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2005 - 2020, Intel Corporation. All rights reserved.<BR>\r
 (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>\r
 \r
 SPDX-License-Identifier: BSD-2-Clause-Patent\r
@@ -711,10 +711,6 @@ Ip4PreProcessPacket (
   //\r
   // Check if the IP4 header is correctly formatted.\r
   //\r
-  if ((*Packet)->TotalSize < IP4_MIN_HEADLEN) {\r
-    return EFI_INVALID_PARAMETER;\r
-  }\r
-\r
   HeadLen  = (Head->HeadLen << 2);\r
   TotalLen = NTOHS (Head->TotalLen);\r
 \r
@@ -808,6 +804,30 @@ Ip4PreProcessPacket (
   return EFI_SUCCESS;\r
 }\r
 \r
+/**\r
+  This function checks the IPv4 packet length.\r
+\r
+  @param[in]       Packet          Pointer to the IPv4 Packet to be checked.\r
+\r
+  @retval TRUE                   The input IPv4 packet length is valid.\r
+  @retval FALSE                  The input IPv4 packet length is invalid.\r
+\r
+**/\r
+BOOLEAN\r
+Ip4IsValidPacketLength (\r
+  IN NET_BUF        *Packet\r
+  )\r
+{\r
+  //\r
+  // Check the IP4 packet length.\r
+  //\r
+  if (Packet->TotalSize < IP4_MIN_HEADLEN) {\r
+    return FALSE;\r
+  }\r
+\r
+  return TRUE;\r
+}\r
+\r
 /**\r
   The IP4 input routine. It is called by the IP4_INTERFACE when a\r
   IP4 fragment is received from MNP.\r
@@ -844,6 +864,10 @@ Ip4AccpetFrame (
     goto DROP;\r
   }\r
 \r
+  if (!Ip4IsValidPacketLength (Packet)) {\r
+    goto RESTART;\r
+  }\r
+\r
   Head      = (IP4_HEAD *) NetbufGetByte (Packet, 0, NULL);\r
   ASSERT (Head != NULL);\r
   OptionLen = (Head->HeadLen << 2) - IP4_MIN_HEADLEN;\r
@@ -890,10 +914,14 @@ Ip4AccpetFrame (
   //\r
   ZeroMem (&ZeroHead, sizeof (IP4_HEAD));\r
   if (0 == CompareMem (Head, &ZeroHead, sizeof (IP4_HEAD))) {\r
-  // Packet may have been changed. Head, HeadLen, TotalLen, and\r
-  // info must be reloaded before use. The ownership of the packet\r
-  // is transferred to the packet process logic.\r
-  //\r
+    // Packet may have been changed. Head, HeadLen, TotalLen, and\r
+    // info must be reloaded before use. The ownership of the packet\r
+    // is transferred to the packet process logic.\r
+    //\r
+    if (!Ip4IsValidPacketLength (Packet)) {\r
+      goto RESTART;\r
+    }\r
+\r
     Head = (IP4_HEAD *) NetbufGetByte (Packet, 0, NULL);\r
     ASSERT (Head != NULL);\r
     Status = Ip4PreProcessPacket (\r