add security check.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@8819 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c b/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
index aa4707294be595d035461c6424603437d3ff1f45..a3923d95bd8e006d161abb9363370f7887247d9e 100644 (file)
--- a/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
+++ b/MdeModulePkg/Universal/Network/ArpDxe/ArpImpl.c
@@ -1617,7 +1617,7 @@ ArpFindCacheEntry (
     //\r
     // Set the fields in FindData.\r
     //\r
-    FindData->Size            = *EntryLength;\r
+    FindData->Size            = FoundEntryLength;\r
     FindData->DenyFlag        = (BOOLEAN)(CacheTable == &ArpService->DeniedCacheTable);\r
     FindData->StaticFlag      = (BOOLEAN)(CacheEntry->DefaultDecayTime == 0);\r
     FindData->HwAddressType   = ArpService->SnpMode.IfType;\r
@@ -1646,7 +1646,7 @@ ArpFindCacheEntry (
     //\r
     // Slip to the next FindData.\r
     //\r
-    FindData = (EFI_ARP_FIND_DATA *)((UINT8 *)FindData + *EntryLength);\r
+    FindData = (EFI_ARP_FIND_DATA *)((UINT8 *)FindData + FoundEntryLength);\r
   }\r
 \r
 CLEAN_EXIT:\r

diff --git a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.c b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.c
index 11b8978b400581dc6add2a2ff943e4eb99d81e8d..aa5009abf320512b5300d587161fc78528a0acc2 100644 (file)
--- a/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.c
+++ b/MdeModulePkg/Universal/Network/Dhcp4Dxe/Dhcp4Option.c
@@ -824,6 +824,7 @@ DhcpBuild (
   if (EFI_ERROR (Status)) {\r
     goto ON_ERROR;\r
   }\r
+  ASSERT (SeedOptions != NULL);\r
 \r
   for (Index = 0; Index < (UINT32) Count; Index++) {\r
     Mark[SeedOptions[Index].Tag] = SeedOptions[Index];\r

diff --git a/MdeModulePkg/Universal/Network/SnpDxe/Nvdata.c b/MdeModulePkg/Universal/Network/SnpDxe/Nvdata.c
index 9aa02e1a930ac313f9f075cf402c6ccb7f2b86a3..20d5daa25cb2afbb58ac8e4329d11b4ba2e7140f 100644 (file)
--- a/MdeModulePkg/Universal/Network/SnpDxe/Nvdata.c
+++ b/MdeModulePkg/Universal/Network/SnpDxe/Nvdata.c
@@ -1,8 +1,8 @@
 /** @file\r
-               Implementation of reading and writing operations on the NVRAM device\r
-               attached to a network interface.\r
+       Implementation of reading and writing operations on the NVRAM device\r
+       attached to a network interface.\r
  \r
-Copyright (c) 2004 - 2007, Intel Corporation. <BR> \r
+Copyright (c) 2004 - 2009, Intel Corporation. <BR> \r
 All rights reserved. This program and the accompanying materials are licensed \r
 and made available under the terms and conditions of the BSD License which \r
 accompanies this distribution. The full text of the license may be found at \r
@@ -88,6 +88,8 @@ PxeNvDataRead (
     return EFI_DEVICE_ERROR;\r
   }\r
 \r
+  ASSERT ((Offset + BufferSize) <= sizeof (Db->Data));\r
+\r
   CopyMem (Buffer, Db->Data.Byte + Offset, BufferSize);\r
 \r
   return EFI_SUCCESS;\r

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
index 9b5080f15dbafca09c2be10745f3381ef7f637d7..c04b2032c7762224808452627f722b840b7feb48 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.c
@@ -37,8 +37,6 @@ UINT8 mInterestedDhcp4Tags[PXEBC_DHCP4_TAG_INDEX_MAX] = {
   @param  Seed    Pointer to the message instance of the DHCP4 packet.\r
   @param  Udp4    Pointer to the EFI_UDP4_PROTOCOL instance.\r
 \r
-  @return none.\r
-\r
 **/\r
 VOID\r
 PxeBcInitSeedPacket (\r
@@ -73,8 +71,6 @@ PxeBcInitSeedPacket (
   @param  Dst   Pointer to the EFI_DHCP4_PROTOCOL instance.\r
   @param  Src   Pointer to the EFI_DHCP4_PROTOCOL instance.\r
 \r
-  @return None.\r
-\r
 **/\r
 VOID\r
 PxeBcCopyEfiDhcp4Packet (\r
@@ -96,8 +92,6 @@ PxeBcCopyEfiDhcp4Packet (
   @param  OfferIndex    Index of cached packets as complements of pxe mode data,\r
                         the index is maximum offer number.\r
 \r
-  @return None.\r
-\r
 **/\r
 VOID\r
 PxeBcCopyProxyOffer (\r
@@ -109,6 +103,7 @@ PxeBcCopyProxyOffer (
   EFI_DHCP4_PACKET        *Offer;\r
 \r
   ASSERT (OfferIndex < Private->NumOffers);\r
+  ASSERT (OfferIndex < PXEBC_MAX_OFFER_NUM);\r
 \r
   Mode  = Private->PxeBc.Mode;\r
   Offer = &Private->Dhcp4Offers[OfferIndex].Packet.Offer;\r
@@ -532,8 +527,6 @@ PxeBcCheckSelectedOffer (
   @param  Private    Pointer to PxeBc private data.\r
   @param  RcvdOffer  Pointer to the received Dhcp proxy offer packet.\r
 \r
-  @return None.\r
-\r
 **/\r
 VOID\r
 PxeBcCacheDhcpOffer (\r
@@ -624,8 +617,6 @@ PxeBcCacheDhcpOffer (
   \r
   @param  Private   Pointer to PxeBc private data.\r
 \r
-  @return None\r
-\r
 **/\r
 VOID\r
 PxeBcSelectOffer (\r
@@ -1465,8 +1456,6 @@ PxeBcParseVendorOptions (
   @param  Str     Pointer to a string (boot item string).\r
   @param  Len     The length of string.\r
 \r
-  @return None.\r
-\r
 **/\r
 VOID\r
 PxeBcDisplayBootItem (\r

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.h
index d1e6ca28d29fab82523da3eb73d7cafb64dcb995..103ae2f57d204eadf2fe7cdc4a32dea1be09119e 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcDhcp.h
@@ -305,8 +305,6 @@ typedef struct {
   @param  Seed    Pointer to the message instance of the DHCP4 packet.\r
   @param  Udp4    Pointer to the EFI_UDP4_PROTOCOL instance.\r
 \r
-  @return none.\r
-\r
 **/\r
 VOID\r
 PxeBcInitSeedPacket (\r
@@ -447,8 +445,6 @@ PxeBcBuildDhcpOptions (
   @param  Layer      the layer of the boot options \r
   @param  OptLen     length of opotion\r
 \r
-  @return None.\r
-\r
 **/\r
 VOID\r
 PxeBcCreateBootOptions (\r

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcImpl.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcImpl.c
index 663d4a0202826dcd290d66708faeb881e663f304..4a91f1c3d16d7862186fc7864eed07b12dbd8459 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcImpl.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcImpl.c
@@ -84,8 +84,6 @@ UpdateArpCache (
 \r
   @param  Event              Pointer to EFI_PXE_BC_PROTOCOL\r
   @param  Context            Context of the timer event\r
-  \r
-  @return None.\r
 \r
 **/\r
 VOID\r
@@ -139,8 +137,6 @@ FindInArpCache (
 \r
   @param  Context               The PXEBC private data.\r
 \r
-  @return None.\r
-\r
 **/\r
 VOID\r
 EFIAPI\r
@@ -233,8 +229,6 @@ Resume:
   @param  Event                 The event signaled.\r
   @param  Context               The context passed in by the event notifier.\r
 \r
-  @return None.\r
-\r
 **/\r
 VOID\r
 EFIAPI\r

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
index 087c2619aa0967956e31fbb046e23bae329f5020..0a67fdeda26a2d8133e96906b2bcc400d348aab9 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.c
@@ -142,8 +142,6 @@ GetSmbiosSystemGuidAndSerialNumber (
   @param  Event     The event signaled.\r
   @param  Context   The context.\r
 \r
-  @return None\r
-\r
 **/\r
 VOID\r
 EFIAPI\r

diff --git a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
index deca161bb1b1f625760296473f9bd373675ef216..b006e38042cc05d794ac84c025dddcfde6de89f9 100644 (file)
--- a/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
+++ b/MdeModulePkg/Universal/Network/UefiPxeBcDxe/PxeBcSupport.h
@@ -38,8 +38,6 @@ GetSmbiosSystemGuidAndSerialNumber (
   @param  Event     The event signaled.\r
   @param  Context   The context.\r
 \r
-  @return None\r
-\r
 **/\r
 VOID\r
 EFIAPI\r