NetworkPkg: Avoid potential NULL pointer dereference

The commit of 6b16c9e7 removes ASSERT and use error handling
in IpSecDxe driver, but may cause the potential NULL pointer
dereference. So, this patch is used to avoid NULL pointer
dereference.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Zhang Lubo <lubo.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>

diff --git a/NetworkPkg/IpSecDxe/IkePacket.c b/NetworkPkg/IpSecDxe/IkePacket.c
index 8fd395d43fa581c37e9ed91675b4a686107abe7a..14dbb9d5d67ec56f08b19168b865a2e6e9705b23 100644 (file)
--- a/NetworkPkg/IpSecDxe/IkePacket.c
+++ b/NetworkPkg/IpSecDxe/IkePacket.c
@@ -1,7 +1,7 @@
 /** @file\r
   IKE Packet related operation.\r
 \r
-  Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -195,6 +195,9 @@ IkeNetbufFromPacket (
   LIST_ENTRY    *PacketEntry;\r
   LIST_ENTRY    *Entry;\r
   IKE_PAYLOAD   *IkePayload;\r
+  EFI_STATUS    RetStatus;\r
+\r
+  RetStatus = EFI_SUCCESS;\r
 \r
   if (!IkePacket->IsEncoded) {\r
     IkePacket->IsEncoded = TRUE;\r
@@ -203,10 +206,14 @@ IkeNetbufFromPacket (
     // Encryption payloads if needed\r
     //\r
     if (((IKEV2_SESSION_COMMON *) SessionCommon)->IkeVer == 2) {\r
-      Ikev2EncodePacket ((IKEV2_SESSION_COMMON *) SessionCommon, IkePacket, IkeType);\r
+      RetStatus = Ikev2EncodePacket ((IKEV2_SESSION_COMMON *) SessionCommon, IkePacket, IkeType);\r
+      if (EFI_ERROR (RetStatus)) {\r
+        return NULL;\r
+      }\r
+      \r
     } else {\r
       //\r
-      //If IKEv1 support, check it here.\r
+      // If IKEv1 support, check it here.\r
       //\r
       return NULL;\r
     }\r

diff --git a/NetworkPkg/IpSecDxe/Ikev2/ChildSa.c b/NetworkPkg/IpSecDxe/Ikev2/ChildSa.c
index d3859e221d1ea209788ba5561e411062d4e6fced..1f0199b22d90314599ca3b6c371157dbf5e29035 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/ChildSa.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/ChildSa.c
@@ -1,7 +1,7 @@
 /** @file\r
   The operations for Child SA.\r
 \r
-  Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -39,18 +39,21 @@ Ikev2CreateChildGenerator (
   IKE_PACKET              *IkePacket;\r
   IKE_PAYLOAD             *NotifyPayload;\r
   UINT32                  *MessageId;\r
+\r
+  NotifyPayload   = NULL;\r
+  MessageId       = NULL;\r
   \r
   ChildSaSession  = (IKEV2_CHILD_SA_SESSION *) SaSession;\r
-  IkePacket       = IkePacketAlloc();\r
-  MessageId       = NULL;\r
-\r
-  if (IkePacket == NULL) {\r
+  if (ChildSaSession == NULL) {\r
     return NULL;\r
   }\r
-  if (ChildSaSession == NULL) {\r
+    \r
+  IkePacket       = IkePacketAlloc();\r
+  if (IkePacket == NULL) {\r
     return NULL;\r
   }\r
 \r
+\r
   if (Context != NULL) {\r
     MessageId = (UINT32 *) Context;\r
   }\r
@@ -113,6 +116,10 @@ Ikev2CreateChildGenerator (
                     NULL,\r
                     0\r
                     );\r
+  if (NotifyPayload == NULL) { \r
+    IkePacketFree (IkePacket);\r
+    return NULL;\r
+  }\r
                         \r
   IKE_PACKET_APPEND_PAYLOAD (IkePacket, NotifyPayload);\r
   //\r

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Exchange.c b/NetworkPkg/IpSecDxe/Ikev2/Exchange.c
index 9d58ab0a46f6b46bb2f58fb3e257a19d042e07a5..1eddbfbcf10432efba87fb17fec87a68057d98d6 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/Exchange.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Exchange.c
@@ -1,7 +1,7 @@
 /** @file\r
   The general interfaces of the IKEv2.\r
 \r
-  Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -495,6 +495,10 @@ Ikev2HandleSa (
             IsListEmpty (&IkeSaSession->ChildSaEstablishSessionList));\r
 \r
     ChildSaSession = Ikev2ChildSaSessionCreate (IkeSaSession, UdpService);\r
+    if (ChildSaSession == NULL) {\r
+      goto ON_ERROR;\r
+    }\r
+    \r
     ChildSaCommon  = &ChildSaSession->SessionCommon;\r
   }\r
 \r
@@ -519,6 +523,10 @@ Ikev2HandleSa (
             IsListEmpty (&IkeSaSession->ChildSaEstablishSessionList));\r
 \r
     ChildSaSession = Ikev2ChildSaSessionCreate (IkeSaSession, UdpService);\r
+    if (ChildSaSession == NULL) {\r
+      goto ON_ERROR;\r
+    }\r
+    \r
     ChildSaCommon  = &ChildSaSession->SessionCommon;\r
 \r
     //\r

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Payload.c b/NetworkPkg/IpSecDxe/Ikev2/Payload.c
index d5fe1abb55c3454b92e74590e87c3b32acb29bd1..675ecf6f747138e57e0d1e3c5200f1a1efb70ebd 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/Payload.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Payload.c
@@ -2558,6 +2558,9 @@ Ikev2EncodePacket (
     // Encrypt all payload and transfer IKE packet header from Host order to Network order.\r
     //\r
     Status = Ikev2EncryptPacket (SessionCommon, IkePacket);\r
+    if (EFI_ERROR (Status)) {\r
+      return Status;\r
+    }\r
   } else {\r
     //\r
     // Fill in the lenght into IkePacket header and transfer Host order to Network order.\r

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Sa.c b/NetworkPkg/IpSecDxe/Ikev2/Sa.c
index c83d45678b60136f65976eed38b1bac3c9584604..74ef79c237193397c88d95258c3d95d0c20e8c86 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/Sa.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Sa.c
@@ -445,6 +445,13 @@ Ikev2AuthPskGenerator (
   IkeSaSession   = (IKEV2_SA_SESSION *) SaSession;\r
   ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (GetFirstNode (&IkeSaSession->ChildSaSessionList));\r
 \r
+  IkePacket      = NULL;\r
+  IdPayload      = NULL;\r
+  AuthPayload    = NULL;\r
+  SaPayload      = NULL;\r
+  TsiPayload     = NULL;\r
+  TsrPayload     = NULL;\r
+  NotifyPayload  = NULL;\r
   CpPayload      = NULL;\r
   NotifyPayload  = NULL;\r
   \r
@@ -488,6 +495,9 @@ Ikev2AuthPskGenerator (
                 &IkeSaSession->SessionCommon,\r
                 IKEV2_PAYLOAD_TYPE_AUTH\r
                 );\r
+  if (IdPayload == NULL) {\r
+    goto CheckError;\r
+  }\r
 \r
   //\r
   // 3. Generate Auth Payload\r
@@ -522,6 +532,14 @@ Ikev2AuthPskGenerator (
                     IKEV2_CFG_ATTR_INTERNAL_IP6_ADDRESS\r
                     );\r
     }\r
+\r
+     if (CpPayload == NULL) {\r
+      goto CheckError;\r
+    }\r
+  }\r
+\r
+  if (AuthPayload == NULL) {\r
+    goto CheckError;\r
   }\r
 \r
   //\r
@@ -532,6 +550,9 @@ Ikev2AuthPskGenerator (
                 IKEV2_PAYLOAD_TYPE_TS_INIT,\r
                 IkeSessionTypeChildSa\r
                 );\r
+  if (SaPayload == NULL) {\r
+    goto CheckError;\r
+  }\r
 \r
   if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTransport) {\r
     //\r
@@ -562,6 +583,9 @@ Ikev2AuthPskGenerator (
                       NULL,\r
                       0\r
                       );\r
+    if (NotifyPayload == NULL) {\r
+      goto CheckError;\r
+    }\r
   } else {\r
     //\r
     // Generate Tsr for Tunnel mode.\r
@@ -578,6 +602,10 @@ Ikev2AuthPskGenerator (
                    );\r
   }\r
 \r
+  if (TsiPayload == NULL || TsrPayload == NULL) {\r
+    goto CheckError;\r
+  }\r
+\r
   IKE_PACKET_APPEND_PAYLOAD (IkePacket, IdPayload);\r
   IKE_PACKET_APPEND_PAYLOAD (IkePacket, AuthPayload);\r
   if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTunnel) {\r
@@ -591,6 +619,41 @@ Ikev2AuthPskGenerator (
   }\r
 \r
   return IkePacket;\r
+\r
+CheckError:\r
+  if (IkePacket != NULL) {\r
+    IkePacketFree (IkePacket);\r
+  }\r
+  \r
+  if (IdPayload != NULL) {\r
+    IkePayloadFree (IdPayload);\r
+  }\r
+\r
+  if (AuthPayload != NULL) {\r
+    IkePayloadFree (AuthPayload);\r
+  }\r
+  \r
+  if (CpPayload != NULL) {\r
+    IkePayloadFree (CpPayload);\r
+  }\r
+\r
+  if (SaPayload != NULL) {\r
+    IkePayloadFree (SaPayload);\r
+  }\r
+  \r
+  if (TsiPayload != NULL) {\r
+    IkePayloadFree (TsiPayload);\r
+  }\r
+  \r
+  if (TsrPayload != NULL) {\r
+    IkePayloadFree (TsrPayload);\r
+  }\r
+  \r
+  if (NotifyPayload != NULL) {\r
+    IkePayloadFree (NotifyPayload);\r
+  }\r
+  \r
+  return NULL; \r
 }\r
 \r
 /**\r
@@ -800,7 +863,11 @@ Ikev2AuthPskParser (
   //\r
   // 5. Generate keymats for IPsec protocol.\r
   //\r
-  Ikev2GenerateChildSaKeys (ChildSaSession, NULL);\r
+  Status = Ikev2GenerateChildSaKeys (ChildSaSession, NULL);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
+  \r
   if (IkeSaSession->SessionCommon.IsInitiator) {\r
     //\r
     // 6. Change the state of IkeSaSession\r
@@ -934,7 +1001,13 @@ Ikev2AuthCertGenerator (
   IkeSaSession   = (IKEV2_SA_SESSION *) SaSession;\r
   ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (GetFirstNode (&IkeSaSession->ChildSaSessionList));\r
 \r
+  IkePacket      = NULL;\r
+  IdPayload      = NULL;\r
+  AuthPayload    = NULL;\r
   CpPayload      = NULL;\r
+  SaPayload      = NULL;\r
+  TsiPayload     = NULL;\r
+  TsrPayload     = NULL;\r
   NotifyPayload  = NULL;\r
   CertPayload    = NULL;\r
   CertReqPayload = NULL;\r
@@ -981,6 +1054,9 @@ Ikev2AuthCertGenerator (
                 (UINT8 *)PcdGetPtr (PcdIpsecUefiCertificate),\r
                 PcdGet32 (PcdIpsecUefiCertificateSize)\r
                 );\r
+  if (IdPayload == NULL) {\r
+    goto CheckError;\r
+  }\r
 \r
   //\r
   // 3. Generate Certificate Payload\r
@@ -993,6 +1069,10 @@ Ikev2AuthCertGenerator (
                   IKEV2_CERT_ENCODEING_X509_CERT_SIGN,\r
                   FALSE\r
                   );\r
+  if (CertPayload == NULL) {\r
+    goto CheckError;\r
+  }\r
+  \r
   if (IkeSaSession->SessionCommon.IsInitiator) {\r
     CertReqPayload = Ikev2GenerateCertificatePayload (\r
                        IkeSaSession,\r
@@ -1002,6 +1082,9 @@ Ikev2AuthCertGenerator (
                        IKEV2_CERT_ENCODEING_HASH_AND_URL_OF_X509_CERT,\r
                        TRUE\r
                        );\r
+    if (CertReqPayload == NULL) {\r
+      goto CheckError;\r
+    } \r
   }\r
 \r
   //\r
@@ -1044,8 +1127,16 @@ Ikev2AuthCertGenerator (
                     IKEV2_CFG_ATTR_INTERNAL_IP6_ADDRESS\r
                     );\r
     }\r
+    \r
+    if (CpPayload == NULL) {\r
+      goto CheckError;\r
+    } \r
   }\r
 \r
+  if (AuthPayload == NULL) {\r
+    goto CheckError;\r
+  }  \r
+\r
   //\r
   // 5. Generate SA Payload according to the Sa Data in ChildSaSession\r
   //\r
@@ -1054,6 +1145,9 @@ Ikev2AuthCertGenerator (
                 IKEV2_PAYLOAD_TYPE_TS_INIT,\r
                 IkeSessionTypeChildSa\r
                 );\r
+  if (SaPayload == NULL) {\r
+    goto CheckError;\r
+  }\r
 \r
   if (IkeSaSession->Spd->Data->ProcessingPolicy->Mode == EfiIPsecTransport) {\r
     //\r
@@ -1084,6 +1178,9 @@ Ikev2AuthCertGenerator (
                       NULL,\r
                       0\r
                       );\r
+    if (NotifyPayload == NULL) {\r
+      goto CheckError;\r
+    }\r
   } else {\r
     //\r
     // Generate Tsr for Tunnel mode.\r
@@ -1100,6 +1197,10 @@ Ikev2AuthCertGenerator (
                    );\r
   }\r
 \r
+  if (TsiPayload == NULL || TsrPayload == NULL) {\r
+    goto CheckError;\r
+  }\r
+\r
   IKE_PACKET_APPEND_PAYLOAD (IkePacket, IdPayload);\r
   IKE_PACKET_APPEND_PAYLOAD (IkePacket, CertPayload);\r
   if (IkeSaSession->SessionCommon.IsInitiator) {\r
@@ -1117,6 +1218,49 @@ Ikev2AuthCertGenerator (
   }\r
 \r
   return IkePacket;\r
+\r
+CheckError:\r
+  if (IkePacket != NULL) {\r
+    IkePacketFree (IkePacket);\r
+  }\r
+  \r
+  if (IdPayload != NULL) {\r
+    IkePayloadFree (IdPayload);\r
+  }\r
+\r
+  if (CertPayload != NULL) {\r
+    IkePayloadFree (CertPayload);\r
+  }\r
+  \r
+  if (CertReqPayload != NULL) {\r
+    IkePayloadFree (CertReqPayload);\r
+  }\r
+\r
+  if (AuthPayload != NULL) {\r
+    IkePayloadFree (AuthPayload);\r
+  }\r
+\r
+  if (CpPayload != NULL) {\r
+    IkePayloadFree (CpPayload);\r
+  }\r
+  \r
+  if (SaPayload != NULL) {\r
+    IkePayloadFree (SaPayload);\r
+  }\r
+  \r
+  if (TsiPayload != NULL) {\r
+    IkePayloadFree (TsiPayload);\r
+  }\r
+  \r
+  if (TsrPayload != NULL) {\r
+    IkePayloadFree (TsrPayload);\r
+  }\r
+  \r
+  if (NotifyPayload != NULL) {\r
+    IkePayloadFree (NotifyPayload);\r
+  }\r
+  \r
+  return NULL; \r
 }\r
 \r
 /**\r
@@ -1340,7 +1484,11 @@ Ikev2AuthCertParser (
   //\r
   // 5. Generat keymats for IPsec protocol.\r
   //\r
-  Ikev2GenerateChildSaKeys (ChildSaSession, NULL);\r
+  Status = Ikev2GenerateChildSaKeys (ChildSaSession, NULL);\r
+  if (EFI_ERROR (Status)) {\r
+    goto Exit;\r
+  }\r
+  \r
   if (IkeSaSession->SessionCommon.IsInitiator) {\r
     //\r
     // 6. Change the state of IkeSaSession\r
@@ -1541,7 +1689,10 @@ Ikev2GenerateSaKeys (
   //\r
   // Generate Gxy\r
   //\r
-  Ikev2GenerateSaDhComputeKey (IkeSaSession->IkeKeys->DhBuffer, KePayload);\r
+  Status = Ikev2GenerateSaDhComputeKey (IkeSaSession->IkeKeys->DhBuffer, KePayload);\r
+  if (EFI_ERROR (Status)) {\r
+    goto Exit;\r
+  }\r
 \r
   //\r
   // Get the key length of Authenticaion, Encryption, PRF, and Integrity.\r
@@ -1843,7 +1994,11 @@ Ikev2GenerateChildSaKeys (
     //\r
     // Generate Gxy \r
     //\r
-    Ikev2GenerateSaDhComputeKey (ChildSaSession->DhBuffer, KePayload);\r
+    Status = Ikev2GenerateSaDhComputeKey (ChildSaSession->DhBuffer, KePayload);\r
+    if (EFI_ERROR (Status)) {\r
+      goto Exit;\r
+    }\r
+    \r
     Fragments[0].Data     = ChildSaSession->DhBuffer->GxyBuffer;\r
     Fragments[0].DataSize = ChildSaSession->DhBuffer->GxySize;\r
   }\r