NetworkPkg: Replace ASSERT with error return code in PXE and HTTP boot driver.

This patch remove the ASSERT when receive a DHCP packet large than the maximum
cache buffer size.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>

diff --git a/NetworkPkg/HttpBootDxe/HttpBootDhcp4.c b/NetworkPkg/HttpBootDxe/HttpBootDhcp4.c
index a47a8f494f9ec1cf8c4f0678dddfb429a49a2a07..fcea916225aa859acc76a8c6a427c809627ad2db 100644 (file)
--- a/NetworkPkg/HttpBootDxe/HttpBootDhcp4.c
+++ b/NetworkPkg/HttpBootDxe/HttpBootDhcp4.c
@@ -220,17 +220,24 @@ HttpBootParseDhcp4Options (
   @param[in]  Dst          Pointer to the cache buffer for DHCPv4 packet.\r
   @param[in]  Src          Pointer to the DHCPv4 packet to be cached.\r
 \r
+  @retval     EFI_SUCCESS                Packet is copied.\r
+  @retval     EFI_BUFFER_TOO_SMALL       Cache buffer is not big enough to hold the packet.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 HttpBootCacheDhcp4Packet (\r
   IN EFI_DHCP4_PACKET     *Dst,\r
   IN EFI_DHCP4_PACKET     *Src\r
   )\r
 {\r
-  ASSERT (Dst->Size >= Src->Length);\r
+  if (Dst->Size < Src->Length) {\r
+    return EFI_BUFFER_TOO_SMALL;\r
+  }\r
 \r
   CopyMem (&Dst->Dhcp4, &Src->Dhcp4, Src->Length);\r
   Dst->Length = Src->Length;\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 /**\r
@@ -429,8 +436,10 @@ HttpBootParseDhcp4Packet (
   @param[in]  Private               Pointer to HTTP boot driver private data.\r
   @param[in]  RcvdOffer             Pointer to the received offer packet.\r
 \r
+  @retval     EFI_SUCCESS      Cache and parse the packet successfully.\r
+  @retval     Others           Operation failed.\r
 **/\r
-VOID\r
+EFI_STATUS\r
 HttpBootCacheDhcp4Offer (\r
   IN HTTP_BOOT_PRIVATE_DATA  *Private,\r
   IN EFI_DHCP4_PACKET        *RcvdOffer\r
@@ -439,6 +448,7 @@ HttpBootCacheDhcp4Offer (
   HTTP_BOOT_DHCP4_PACKET_CACHE  *Cache4;\r
   EFI_DHCP4_PACKET              *Offer;\r
   HTTP_BOOT_OFFER_TYPE          OfferType;\r
+  EFI_STATUS                    Status;\r
 \r
   ASSERT (Private->OfferNum < HTTP_BOOT_OFFER_MAX_NUM);\r
   Cache4 = &Private->OfferBuffer[Private->OfferNum].Dhcp4;\r
@@ -447,13 +457,16 @@ HttpBootCacheDhcp4Offer (
   //\r
   // Cache the content of DHCPv4 packet firstly.\r
   //\r
-  HttpBootCacheDhcp4Packet (Offer, RcvdOffer);\r
+  Status = HttpBootCacheDhcp4Packet (Offer, RcvdOffer);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
 \r
   //\r
   // Validate the DHCPv4 packet, and parse the options and offer type.\r
   //\r
   if (EFI_ERROR (HttpBootParseDhcp4Packet (Cache4))) {\r
-    return;\r
+    return EFI_ABORTED;\r
   }\r
 \r
   //\r
@@ -465,6 +478,8 @@ HttpBootCacheDhcp4Offer (
   Private->OfferIndex[OfferType][Private->OfferCount[OfferType]] = Private->OfferNum;\r
   Private->OfferCount[OfferType]++;\r
   Private->OfferNum++;\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 /**\r
@@ -618,10 +633,17 @@ HttpBootDhcp4CallBack (
   switch (Dhcp4Event) {\r
   case Dhcp4RcvdOffer:\r
     Status = EFI_NOT_READY;\r
+    if (Packet->Length > HTTP_BOOT_DHCP4_PACKET_MAX_SIZE) {\r
+      //\r
+      // Ignore the incoming packets which exceed the maximum length.\r
+      //\r
+      break;\r
+    }\r
     if (Private->OfferNum < HTTP_BOOT_OFFER_MAX_NUM) {\r
       //\r
       // Cache the DHCPv4 offers to OfferBuffer[] for select later, and record\r
       // the OfferIndex and OfferCount.\r
+      // If error happens, just ignore this packet and continue to wait more offer.\r
       //\r
       HttpBootCacheDhcp4Offer (Private, Packet);\r
     }\r

diff --git a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
index ca84f2ad9b8242c737f40c978e335d680eda15f6..f2b81957b7189e0dbe4faaadeffc8fd7a2c17117 100644 (file)
--- a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
+++ b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
@@ -329,17 +329,24 @@ HttpBootParseDhcp6Packet (
   @param[in]  Dst          The pointer to the cache buffer for DHCPv6 packet.\r
   @param[in]  Src          The pointer to the DHCPv6 packet to be cached.\r
 \r
+  @retval     EFI_SUCCESS                Packet is copied.\r
+  @retval     EFI_BUFFER_TOO_SMALL       Cache buffer is not big enough to hold the packet.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 HttpBootCacheDhcp6Packet (\r
   IN EFI_DHCP6_PACKET          *Dst,\r
   IN EFI_DHCP6_PACKET          *Src\r
   )\r
 {\r
-  ASSERT (Dst->Size >= Src->Length);\r
+  if (Dst->Size < Src->Length) {\r
+    return EFI_BUFFER_TOO_SMALL;\r
+  }\r
 \r
   CopyMem (&Dst->Dhcp6, &Src->Dhcp6, Src->Length);\r
   Dst->Length = Src->Length;\r
+  \r
+  return EFI_SUCCESS;\r
 }\r
 \r
 /**\r
@@ -348,8 +355,11 @@ HttpBootCacheDhcp6Packet (
   @param[in]  Private               The pointer to HTTP_BOOT_PRIVATE_DATA.\r
   @param[in]  RcvdOffer             The pointer to the received offer packet.\r
 \r
+  @retval     EFI_SUCCESS      Cache and parse the packet successfully.\r
+  @retval     Others           Operation failed.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 HttpBootCacheDhcp6Offer (\r
   IN HTTP_BOOT_PRIVATE_DATA  *Private,\r
   IN EFI_DHCP6_PACKET        *RcvdOffer\r
@@ -358,6 +368,7 @@ HttpBootCacheDhcp6Offer (
   HTTP_BOOT_DHCP6_PACKET_CACHE   *Cache6;\r
   EFI_DHCP6_PACKET               *Offer;\r
   HTTP_BOOT_OFFER_TYPE           OfferType;\r
+  EFI_STATUS                     Status;\r
 \r
   Cache6 = &Private->OfferBuffer[Private->OfferNum].Dhcp6;\r
   Offer  = &Cache6->Packet.Offer;\r
@@ -365,13 +376,16 @@ HttpBootCacheDhcp6Offer (
   //\r
   // Cache the content of DHCPv6 packet firstly.\r
   //\r
-  HttpBootCacheDhcp6Packet(Offer, RcvdOffer);\r
+  Status = HttpBootCacheDhcp6Packet(Offer, RcvdOffer);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
 \r
   //\r
   // Validate the DHCPv6 packet, and parse the options and offer type.\r
   //\r
   if (EFI_ERROR (HttpBootParseDhcp6Packet (Cache6))) {\r
-    return ;\r
+    return EFI_ABORTED;\r
   }\r
 \r
   //\r
@@ -382,7 +396,9 @@ HttpBootCacheDhcp6Offer (
   ASSERT (Private->OfferCount[OfferType] < HTTP_BOOT_OFFER_MAX_NUM);\r
   Private->OfferIndex[OfferType][Private->OfferCount[OfferType]] = Private->OfferNum;\r
   Private->OfferCount[OfferType]++;\r
-  Private->OfferNum++;  \r
+  Private->OfferNum++;\r
+  \r
+  return EFI_SUCCESS;\r
 }\r
 \r
 /**\r
@@ -437,6 +453,7 @@ HttpBootDhcp6CallBack (
        //\r
        // Cache the dhcp offers to OfferBuffer[] for select later, and record\r
        // the OfferIndex and OfferCount.\r
+       // If error happens, just ignore this packet and continue to wait more offer.\r
        //\r
        HttpBootCacheDhcp6Offer (Private, Packet);\r
      }\r

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
index 44b07143934dfdce53716f522b784629e4db4bd5..54973901190c3abaf4abb77b0ef5cb2398fd3310 100644 (file)
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
@@ -424,17 +424,24 @@ PxeBcSeedDhcp4Packet (
   @param[in]  Dst          Pointer to the cache buffer for DHCPv4 packet.\r
   @param[in]  Src          Pointer to the DHCPv4 packet to be cached.\r
 \r
+  @retval     EFI_SUCCESS                Packet is copied.\r
+  @retval     EFI_BUFFER_TOO_SMALL       Cache buffer is not big enough to hold the packet.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 PxeBcCacheDhcp4Packet (\r
   IN EFI_DHCP4_PACKET     *Dst,\r
   IN EFI_DHCP4_PACKET     *Src\r
   )\r
 {\r
-  ASSERT (Dst->Size >= Src->Length);\r
-\r
+  if (Dst->Size < Src->Length) {\r
+    return EFI_BUFFER_TOO_SMALL;\r
+  }\r
+  \r
   CopyMem (&Dst->Dhcp4, &Src->Dhcp4, Src->Length);\r
   Dst->Length = Src->Length;\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 \r
@@ -620,8 +627,11 @@ PxeBcParseDhcp4Packet (
   @param[in]  Ack                 Pointer to the DHCPv4 ack packet.\r
   @param[in]  Verified            If TRUE, parse the ACK packet and store info into mode data.\r
 \r
+  @retval     EFI_SUCCESS                Cache and parse the packet successfully.\r
+  @retval     EFI_BUFFER_TOO_SMALL       Cache buffer is not big enough to hold the packet.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 PxeBcCopyDhcp4Ack (\r
   IN PXEBC_PRIVATE_DATA   *Private,\r
   IN EFI_DHCP4_PACKET     *Ack,\r
@@ -629,10 +639,14 @@ PxeBcCopyDhcp4Ack (
   )\r
 {\r
   EFI_PXE_BASE_CODE_MODE  *Mode;\r
+  EFI_STATUS              Status;\r
 \r
   Mode = Private->PxeBc.Mode;\r
 \r
-  PxeBcCacheDhcp4Packet (&Private->DhcpAck.Dhcp4.Packet.Ack, Ack);\r
+  Status = PxeBcCacheDhcp4Packet (&Private->DhcpAck.Dhcp4.Packet.Ack, Ack);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
 \r
   if (Verified) {\r
     //\r
@@ -642,6 +656,8 @@ PxeBcCopyDhcp4Ack (
     CopyMem (&Mode->DhcpAck.Dhcpv4, &Ack->Dhcp4, Ack->Length);\r
     Mode->DhcpAckReceived = TRUE;\r
   }\r
+  \r
+  return EFI_SUCCESS;\r
 }\r
 \r
 \r
@@ -651,8 +667,11 @@ PxeBcCopyDhcp4Ack (
   @param[in]  Private               Pointer to PxeBc private data.\r
   @param[in]  OfferIndex            The received order of offer packets.\r
 \r
+  @retval     EFI_SUCCESS                Cache and parse the packet successfully.\r
+  @retval     EFI_BUFFER_TOO_SMALL       Cache buffer is not big enough to hold the packet.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 PxeBcCopyProxyOffer (\r
   IN PXEBC_PRIVATE_DATA   *Private,\r
   IN UINT32               OfferIndex\r
@@ -660,6 +679,7 @@ PxeBcCopyProxyOffer (
 {\r
   EFI_PXE_BASE_CODE_MODE  *Mode;\r
   EFI_DHCP4_PACKET        *Offer;\r
+  EFI_STATUS              Status;\r
 \r
   ASSERT (OfferIndex < Private->OfferNum);\r
   ASSERT (OfferIndex < PXEBC_OFFER_MAX_NUM);\r
@@ -670,7 +690,11 @@ PxeBcCopyProxyOffer (
   //\r
   // Cache the proxy offer packet and parse it.\r
   //\r
-  PxeBcCacheDhcp4Packet (&Private->ProxyOffer.Dhcp4.Packet.Offer, Offer);\r
+  Status = PxeBcCacheDhcp4Packet (&Private->ProxyOffer.Dhcp4.Packet.Offer, Offer);\r
+  if (EFI_ERROR(Status)) {\r
+    return Status;\r
+  }\r
+  \r
   PxeBcParseDhcp4Packet (&Private->ProxyOffer.Dhcp4);\r
 \r
   //\r
@@ -678,6 +702,8 @@ PxeBcCopyProxyOffer (
   //\r
   CopyMem (&Mode->ProxyOffer.Dhcpv4, &Offer->Dhcp4, Offer->Length);\r
   Mode->ProxyOfferReceived = TRUE;\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 \r
@@ -780,8 +806,11 @@ PxeBcRetryBinlOffer (
   @param[in]  Private               Pointer to PxeBc private data.\r
   @param[in]  RcvdOffer             Pointer to the received offer packet.\r
 \r
+  @retval     EFI_SUCCESS      Cache and parse the packet successfully.\r
+  @retval     Others           Operation failed.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 PxeBcCacheDhcp4Offer (\r
   IN PXEBC_PRIVATE_DATA     *Private,\r
   IN EFI_DHCP4_PACKET       *RcvdOffer\r
@@ -790,6 +819,7 @@ PxeBcCacheDhcp4Offer (
   PXEBC_DHCP4_PACKET_CACHE  *Cache4;\r
   EFI_DHCP4_PACKET          *Offer;\r
   PXEBC_OFFER_TYPE          OfferType;\r
+  EFI_STATUS                Status;\r
 \r
   ASSERT (Private->OfferNum < PXEBC_OFFER_MAX_NUM);\r
   Cache4 = &Private->OfferBuffer[Private->OfferNum].Dhcp4;\r
@@ -798,13 +828,16 @@ PxeBcCacheDhcp4Offer (
   //\r
   // Cache the content of DHCPv4 packet firstly.\r
   //\r
-  PxeBcCacheDhcp4Packet (Offer, RcvdOffer);\r
+  Status = PxeBcCacheDhcp4Packet (Offer, RcvdOffer);\r
+  if (EFI_ERROR(Status)) {\r
+    return Status;\r
+  }\r
 \r
   //\r
   // Validate the DHCPv4 packet, and parse the options and offer type.\r
   //\r
   if (EFI_ERROR (PxeBcParseDhcp4Packet (Cache4))) {\r
-    return;\r
+    return EFI_ABORTED;\r
   }\r
 \r
   //\r
@@ -821,7 +854,7 @@ PxeBcCacheDhcp4Offer (
       Private->OfferIndex[OfferType][0] = Private->OfferNum;\r
       Private->OfferCount[OfferType]    = 1;\r
     } else {\r
-      return;\r
+      return EFI_ABORTED;\r
     }\r
   } else {\r
     ASSERT (Private->OfferCount[OfferType] < PXEBC_OFFER_MAX_NUM);\r
@@ -844,7 +877,7 @@ PxeBcCacheDhcp4Offer (
         Private->OfferIndex[OfferType][0] = Private->OfferNum;\r
         Private->OfferCount[OfferType]    = 1;\r
       } else {\r
-        return ;\r
+        return EFI_ABORTED;\r
       }\r
     } else {\r
       //\r
@@ -856,6 +889,8 @@ PxeBcCacheDhcp4Offer (
   }\r
 \r
   Private->OfferNum++;\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 \r
@@ -980,11 +1015,12 @@ PxeBcSelectDhcp4Offer (
 /**\r
   Handle the DHCPv4 offer packet.\r
 \r
-  @param[in]  Private             Pointer to PxeBc private data.\r
+  @param[in]  Private               Pointer to PxeBc private data.\r
 \r
-  @retval     EFI_SUCCESS         Handled the DHCPv4 offer packet successfully.\r
-  @retval     EFI_NO_RESPONSE     No response to the following request packet.\r
-  @retval     EFI_NOT_FOUND       No boot filename received.\r
+  @retval     EFI_SUCCESS           Handled the DHCPv4 offer packet successfully.\r
+  @retval     EFI_NO_RESPONSE       No response to the following request packet.\r
+  @retval     EFI_NOT_FOUND         No boot filename received.\r
+  @retval     EFI_BUFFER_TOO_SMALL  Can't cache the offer pacet.\r
 \r
 **/\r
 EFI_STATUS\r
@@ -1089,7 +1125,7 @@ PxeBcHandleDhcp4Offer (
         //\r
         // Success to try to request by a ProxyPxe10 or ProxyWfm11a offer, copy and parse it.\r
         //\r
-        PxeBcCopyProxyOffer (Private, ProxyIndex);\r
+        Status = PxeBcCopyProxyOffer (Private, ProxyIndex);\r
       }\r
     } else {\r
       //\r
@@ -1116,7 +1152,10 @@ PxeBcHandleDhcp4Offer (
       Ack = Offer;\r
     }\r
 \r
-    PxeBcCopyDhcp4Ack (Private, Ack, TRUE);\r
+    Status = PxeBcCopyDhcp4Ack (Private, Ack, TRUE);\r
+    if (EFI_ERROR (Status)) {\r
+      return Status;\r
+    }\r
     Mode->DhcpDiscoverValid = TRUE;\r
   }\r
 \r
@@ -1258,6 +1297,7 @@ PxeBcDhcp4CallBack (
       //\r
       // Cache the DHCPv4 offers to OfferBuffer[] for select later, and record\r
       // the OfferIndex and OfferCount.\r
+      // If error happens, just ignore this packet and continue to wait more offer.\r
       //\r
       PxeBcCacheDhcp4Offer (Private, Packet);\r
     }\r
@@ -1278,21 +1318,16 @@ PxeBcDhcp4CallBack (
     break;\r
 \r
   case Dhcp4RcvdAck:\r
-    if (Packet->Length > PXEBC_DHCP4_PACKET_MAX_SIZE) {\r
-      //\r
-      // Abort the DHCP if the ACK packet exceeds the maximum length.\r
-      //\r
-         Status = EFI_ABORTED;\r
-         break;\r
-    }\r
-\r
     //\r
     // Cache the DHCPv4 ack to Private->Dhcp4Ack, but it's not the final ack in mode data\r
     // without verification.\r
     //\r
     ASSERT (Private->SelectIndex != 0);\r
 \r
-    PxeBcCopyDhcp4Ack (Private, Packet, FALSE);\r
+    Status = PxeBcCopyDhcp4Ack (Private, Packet, FALSE);\r
+    if (EFI_ERROR (Status)) {\r
+      Status = EFI_ABORTED;\r
+    }\r
     break;\r
 \r
   default:\r
@@ -1491,6 +1526,12 @@ PxeBcDhcp4Discover (
     // Find the right PXE Reply according to server address.\r
     //\r
     while (RepIndex < Token.ResponseCount) {\r
+      if (Response->Length > PXEBC_DHCP4_PACKET_MAX_SIZE) {\r
+        SrvIndex = 0;\r
+        RepIndex++;\r
+        Response = (EFI_DHCP4_PACKET *) ((UINT8 *) Response + Response->Size);\r
+        continue;\r
+      }\r
 \r
       while (SrvIndex < IpCount) {\r
         if (SrvList[SrvIndex].AcceptAnyResponse) {\r
@@ -1509,7 +1550,6 @@ PxeBcDhcp4Discover (
 \r
       SrvIndex = 0;\r
       RepIndex++;\r
-\r
       Response = (EFI_DHCP4_PACKET *) ((UINT8 *) Response + Response->Size);\r
     }\r
 \r
@@ -1519,10 +1559,16 @@ PxeBcDhcp4Discover (
       // Especially for PXE discover packet, store it into mode data here.\r
       //\r
       if (Private->IsDoDiscover) {\r
-        PxeBcCacheDhcp4Packet (&Private->PxeReply.Dhcp4.Packet.Ack, Response);\r
+        Status = PxeBcCacheDhcp4Packet (&Private->PxeReply.Dhcp4.Packet.Ack, Response);\r
+        if (EFI_ERROR(Status)) {\r
+          goto ON_EXIT;\r
+        }\r
         CopyMem (&Mode->PxeDiscover, &Token.Packet->Dhcp4, Token.Packet->Length);\r
       } else {\r
-        PxeBcCacheDhcp4Packet (&Private->ProxyOffer.Dhcp4.Packet.Offer, Response);\r
+        Status = PxeBcCacheDhcp4Packet (&Private->ProxyOffer.Dhcp4.Packet.Offer, Response);\r
+        if (EFI_ERROR(Status)) {\r
+          goto ON_EXIT;\r
+        }\r
       }\r
     } else {\r
       //\r
@@ -1530,12 +1576,15 @@ PxeBcDhcp4Discover (
       //\r
       Status = EFI_NOT_FOUND;\r
     }\r
-    if (Token.ResponseList != NULL) {\r
-      FreePool (Token.ResponseList);\r
-    }\r
   }\r
-\r
-  FreePool (Token.Packet);\r
+ON_EXIT:\r
+  \r
+  if (Token.ResponseList != NULL) {\r
+    FreePool (Token.ResponseList);\r
+  }\r
+  if (Token.Packet != NULL) {\r
+    FreePool (Token.Packet);\r
+  }\r
   return Status;\r
 }\r
 \r

diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
index 6a08e9a2de68a56cebf1c71174ec6364af4119bc..a295b827afbca7a37e165cc2144bca85b0625e8c 100644 (file)
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
@@ -181,17 +181,24 @@ PxeBcBuildDhcp6Options (
   @param[in]  Dst          The pointer to the cache buffer for DHCPv6 packet.\r
   @param[in]  Src          The pointer to the DHCPv6 packet to be cached.\r
 \r
+  @retval     EFI_SUCCESS                Packet is copied.\r
+  @retval     EFI_BUFFER_TOO_SMALL       Cache buffer is not big enough to hold the packet.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 PxeBcCacheDhcp6Packet (\r
   IN EFI_DHCP6_PACKET          *Dst,\r
   IN EFI_DHCP6_PACKET          *Src\r
   )\r
 {\r
-  ASSERT (Dst->Size >= Src->Length);\r
+  if (Dst->Size < Src->Length) {\r
+    return EFI_BUFFER_TOO_SMALL;\r
+  }\r
 \r
   CopyMem (&Dst->Dhcp6, &Src->Dhcp6, Src->Length);\r
   Dst->Length = Src->Length;\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 \r
@@ -749,8 +756,11 @@ PxeBcParseDhcp6Packet (
   @param[in]  Ack                 The pointer to the DHCPv6 ack packet.\r
   @param[in]  Verified            If TRUE, parse the ACK packet and store info into mode data.\r
 \r
+  @retval     EFI_SUCCESS                Cache and parse the packet successfully.\r
+  @retval     EFI_BUFFER_TOO_SMALL       Cache buffer is not big enough to hold the packet.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 PxeBcCopyDhcp6Ack (\r
   IN PXEBC_PRIVATE_DATA   *Private,\r
   IN EFI_DHCP6_PACKET     *Ack,\r
@@ -758,10 +768,14 @@ PxeBcCopyDhcp6Ack (
   )\r
 {\r
   EFI_PXE_BASE_CODE_MODE  *Mode;\r
+  EFI_STATUS              Status;\r
 \r
   Mode = Private->PxeBc.Mode;\r
 \r
-  PxeBcCacheDhcp6Packet (&Private->DhcpAck.Dhcp6.Packet.Ack, Ack);\r
+  Status = PxeBcCacheDhcp6Packet (&Private->DhcpAck.Dhcp6.Packet.Ack, Ack);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
 \r
   if (Verified) {\r
     //\r
@@ -771,6 +785,8 @@ PxeBcCopyDhcp6Ack (
     CopyMem (&Mode->DhcpAck.Dhcpv6, &Ack->Dhcp6, Ack->Length);\r
     Mode->DhcpAckReceived = TRUE;\r
   }\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 \r
@@ -780,8 +796,11 @@ PxeBcCopyDhcp6Ack (
   @param[in]  Private               The pointer to PxeBc private data.\r
   @param[in]  OfferIndex            The received order of offer packets.\r
 \r
+  @retval     EFI_SUCCESS                Cache and parse the packet successfully.\r
+  @retval     EFI_BUFFER_TOO_SMALL       Cache buffer is not big enough to hold the packet.\r
+\r
 **/\r
-VOID\r
+EFI_STATUS\r
 PxeBcCopyDhcp6Proxy (\r
   IN PXEBC_PRIVATE_DATA     *Private,\r
   IN UINT32                 OfferIndex\r
@@ -789,6 +808,7 @@ PxeBcCopyDhcp6Proxy (
 {\r
   EFI_PXE_BASE_CODE_MODE    *Mode;\r
   EFI_DHCP6_PACKET          *Offer;\r
+  EFI_STATUS              Status;\r
 \r
   ASSERT (OfferIndex < Private->OfferNum);\r
   ASSERT (OfferIndex < PXEBC_OFFER_MAX_NUM);\r
@@ -799,7 +819,10 @@ PxeBcCopyDhcp6Proxy (
   //\r
   // Cache the proxy offer packet and parse it.\r
   //\r
-  PxeBcCacheDhcp6Packet (&Private->ProxyOffer.Dhcp6.Packet.Offer, Offer);\r
+  Status = PxeBcCacheDhcp6Packet (&Private->ProxyOffer.Dhcp6.Packet.Offer, Offer);\r
+  if (EFI_ERROR(Status)) {\r
+    return Status;\r
+  }\r
   PxeBcParseDhcp6Packet (&Private->ProxyOffer.Dhcp6);\r
 \r
   //\r
@@ -807,6 +830,8 @@ PxeBcCopyDhcp6Proxy (
   //\r
   CopyMem (&Mode->ProxyOffer.Dhcpv6, &Offer->Dhcp6, Offer->Length);\r
   Mode->ProxyOfferReceived = TRUE;\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 /**\r
@@ -1121,8 +1146,10 @@ PxeBcRetryDhcp6Binl (
   @param[in]  Private               The pointer to PXEBC_PRIVATE_DATA.\r
   @param[in]  RcvdOffer             The pointer to the received offer packet.\r
 \r
+  @retval     EFI_SUCCESS      Cache and parse the packet successfully.\r
+  @retval     Others           Operation failed.\r
 **/\r
-VOID\r
+EFI_STATUS\r
 PxeBcCacheDhcp6Offer (\r
   IN PXEBC_PRIVATE_DATA     *Private,\r
   IN EFI_DHCP6_PACKET       *RcvdOffer\r
@@ -1131,6 +1158,7 @@ PxeBcCacheDhcp6Offer (
   PXEBC_DHCP6_PACKET_CACHE  *Cache6;\r
   EFI_DHCP6_PACKET          *Offer;\r
   PXEBC_OFFER_TYPE          OfferType;\r
+  EFI_STATUS                Status;\r
 \r
   Cache6 = &Private->OfferBuffer[Private->OfferNum].Dhcp6;\r
   Offer  = &Cache6->Packet.Offer;\r
@@ -1138,13 +1166,16 @@ PxeBcCacheDhcp6Offer (
   //\r
   // Cache the content of DHCPv6 packet firstly.\r
   //\r
-  PxeBcCacheDhcp6Packet (Offer, RcvdOffer);\r
+  Status = PxeBcCacheDhcp6Packet (Offer, RcvdOffer);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
 \r
   //\r
   // Validate the DHCPv6 packet, and parse the options and offer type.\r
   //\r
   if (EFI_ERROR (PxeBcParseDhcp6Packet (Cache6))) {\r
-    return ;\r
+    return EFI_ABORTED;\r
   }\r
 \r
   //\r
@@ -1173,7 +1204,7 @@ PxeBcCacheDhcp6Offer (
       Private->OfferIndex[OfferType][0] = Private->OfferNum;\r
       Private->OfferCount[OfferType]    = 1;\r
     } else {\r
-      return;\r
+      return EFI_ABORTED;\r
     }\r
   } else {\r
     //\r
@@ -1184,6 +1215,8 @@ PxeBcCacheDhcp6Offer (
   }\r
 \r
   Private->OfferNum++;\r
+\r
+  return EFI_SUCCESS;\r
 }\r
 \r
 \r
@@ -1301,6 +1334,7 @@ PxeBcSelectDhcp6Offer (
   @retval     EFI_SUCCESS           Handled the DHCPv6 offer packet successfully.\r
   @retval     EFI_NO_RESPONSE       No response to the following request packet.\r
   @retval     EFI_OUT_OF_RESOURCES  Failed to allocate resources.\r
+  @retval     EFI_BUFFER_TOO_SMALL  Can't cache the offer pacet.\r
 \r
 **/\r
 EFI_STATUS\r
@@ -1410,7 +1444,7 @@ PxeBcHandleDhcp6Offer (
         //\r
         // Success to try to request by a ProxyPxe10 or ProxyWfm11a offer, copy and parse it.\r
         //\r
-        PxeBcCopyDhcp6Proxy (Private, ProxyIndex);\r
+        Status = PxeBcCopyDhcp6Proxy (Private, ProxyIndex);\r
       }\r
     } else {\r
       //\r
@@ -1424,7 +1458,7 @@ PxeBcHandleDhcp6Offer (
     //\r
     // All PXE boot information is ready by now.\r
     //\r
-    PxeBcCopyDhcp6Ack (Private, &Private->DhcpAck.Dhcp6.Packet.Ack, TRUE);\r
+    Status = PxeBcCopyDhcp6Ack (Private, &Private->DhcpAck.Dhcp6.Packet.Ack, TRUE);\r
     Private->PxeBc.Mode->DhcpDiscoverValid = TRUE;\r
   }\r
 \r
@@ -1997,19 +2031,15 @@ PxeBcDhcp6CallBack (
     break;\r
 \r
   case Dhcp6RcvdReply:\r
-    if (Packet->Length > PXEBC_DHCP6_PACKET_MAX_SIZE) {\r
-      //\r
-      // Abort the DHCP if the Peply packet exceeds the maximum length.\r
-      //\r
-         Status = EFI_ABORTED;\r
-      break;\r
-    }\r
     //\r
     // Cache the dhcp ack to Private->Dhcp6Ack, but it's not the final ack in mode data\r
     // without verification.\r
     //\r
     ASSERT (Private->SelectIndex != 0);\r
-    PxeBcCopyDhcp6Ack (Private, Packet, FALSE);\r
+    Status = PxeBcCopyDhcp6Ack (Private, Packet, FALSE);\r
+    if (EFI_ERROR (Status)) {\r
+      Status = EFI_ABORTED;\r
+    }\r
     break;\r
 \r
   default:\r