Fix a memory use after free bug in DHCP6 driver.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu, Siyuan <siyuan.fu@intel.com>
Reviewed-By: Ye, Ting <ting.ye@intel.com>
Reviewed-by: Wu, Jiaxin <jiaxin.wu@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15651 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
index 1da31dcc5411a8562bf2b65418562b518e5415c8..e0a2b4b15f298625993852c6d4e758e3691d80df 100644 (file)
--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
@@ -1,7 +1,7 @@
 /** @file\r
   Dhcp6 internal functions implementation.\r
 \r
-  Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -363,6 +363,32 @@ Dhcp6CleanupRetry (
   }\r
 }\r
 \r
+/**\r
+  Check whether the TxCb is still a valid control block in the instance's retry list.\r
+\r
+  @param[in]  Instance       The pointer to DHCP6_INSTANCE.\r
+  @param[in]  TxCb           The control block for a transmitted message.\r
+\r
+  @retval   TRUE      The control block is in Instance's retry list.\r
+  @retval   FALSE     The control block is NOT in Instance's retry list.\r
+  \r
+**/\r
+BOOLEAN\r
+Dhcp6IsValidTxCb (\r
+  IN  DHCP6_INSTANCE          *Instance,\r
+  IN  DHCP6_TX_CB             *TxCb\r
+  )\r
+{\r
+  LIST_ENTRY                *Entry;\r
+\r
+  NET_LIST_FOR_EACH (Entry, &Instance->TxList) {\r
+    if (TxCb == NET_LIST_USER_STRUCT (Entry, DHCP6_TX_CB, Link)) {\r
+      return TRUE;\r
+    }\r
+  }\r
+\r
+  return FALSE;\r
+}\r
 \r
 /**\r
   Clean up the session of the instance stateful exchange.\r
@@ -3097,7 +3123,8 @@ Dhcp6OnTimerTick (
 \r
  ON_CLOSE:\r
 \r
-  if (TxCb->TxPacket != NULL &&\r
+  if (Dhcp6IsValidTxCb (Instance, TxCb) &&\r
+      TxCb->TxPacket != NULL &&\r
       (TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgInfoRequest ||\r
       TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgRenew       ||\r
       TxCb->TxPacket->Dhcp6.Header.MessageType == Dhcp6MsgConfirm)\r