MdeModulePkg/DxeHttpLib: Fix the incorrect return status if URI port is invalid

Cc: Zhang Lubo <lubo.zhang@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Zhang Lubo <lubo.zhang@intel.com>

diff --git a/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c b/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c
index 2ff04ffad3ac1b4976c20e1f18a9c12a041f14bd..8e29213a4f2e5813f7eccae04d6087724b8f82b6 100644 (file)
--- a/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c
+++ b/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c
@@ -692,6 +692,7 @@ HttpUrlGetPort (
 {\r
   CHAR8         *PortString;\r
   EFI_STATUS    Status;\r
+  UINTN         Index;\r
   UINTN         Data;\r
   UINT32        ResultLength;\r
   HTTP_URL_PARSER      *Parser;\r
@@ -700,6 +701,9 @@ HttpUrlGetPort (
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
+  *Port = 0;\r
+  Index = 0;\r
+\r
   Parser = (HTTP_URL_PARSER*) UrlParser;\r
 \r
   if ((Parser->FieldBitMap & BIT (HTTP_URI_FIELD_PORT)) == 0) {\r
@@ -723,8 +727,19 @@ HttpUrlGetPort (
 \r
   PortString[ResultLength] = '\0';\r
 \r
+  while (Index < ResultLength) {\r
+    if (!NET_IS_DIGIT (PortString[Index])) {\r
+      return EFI_INVALID_PARAMETER;\r
+    }\r
+    Index ++;\r
+  }\r
+\r
   Status =  AsciiStrDecimalToUintnS (Url + Parser->FieldData[HTTP_URI_FIELD_PORT].Offset, (CHAR8 **) NULL, &Data);\r
 \r
+  if (Data > HTTP_URI_PORT_MAX_NUM || Data < HTTP_URI_PORT_MIN_NUM) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
   *Port = (UINT16) Data;\r
   return Status;\r
 }\r

diff --git a/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.h b/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.h
index 0d0ad3d8ffc34b5d5d1196552402d92b73ed6f18..5ee0fdc61985086bbcf7dfc6adcbfa2eb1f0c68d 100644 (file)
--- a/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.h
+++ b/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.h
@@ -1,7 +1,7 @@
 /** @file\r
 Header file for HttpLib.\r
 \r
-  Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>\r
   (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>\r
 \r
   This program and the accompanying materials\r
@@ -50,6 +50,9 @@ Header file for HttpLib.
 #define   HTTP_URI_FIELD_PORT             7\r
 #define   HTTP_URI_FIELD_MAX              8\r
 \r
+#define   HTTP_URI_PORT_MIN_NUM           0\r
+#define   HTTP_URI_PORT_MAX_NUM           65535\r
+\r
 //\r
 // Structure to store the parse result of a HTTP URL.\r
 //\r