MdeModulePkg: Update DBsize in SNP GetStatus command.

Update the DBsize in GetStatus command to let UNDI return an array of recycled
buffers. This is to make the loop at the end of PxeGetStatus() useful and to
prevent buffer overflow with some non-conformant UNDI drivers which not check
the value of the input DBsize in UNDI GetStatus command.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Sriram Subramanian <sriram-s@hpe.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>

diff --git a/MdeModulePkg/Universal/Network/SnpDxe/Get_status.c b/MdeModulePkg/Universal/Network/SnpDxe/Get_status.c
index 8f2ab9b24ab5b150acdbfb1eddd92d4164133311..fad2e9821253e796d879e09d84b26e6e92abac5f 100644 (file)
--- a/MdeModulePkg/Universal/Network/SnpDxe/Get_status.c
+++ b/MdeModulePkg/Universal/Network/SnpDxe/Get_status.c
@@ -65,11 +65,7 @@ PxeGetStatus (
   Snp->Cdb.CPBsize  = PXE_CPBSIZE_NOT_USED;\r
   Snp->Cdb.CPBaddr  = PXE_CPBADDR_NOT_USED;\r
 \r
-  //\r
-  // size DB for return of one buffer\r
-  //\r
-  Snp->Cdb.DBsize     = (UINT16) ((sizeof (PXE_DB_GET_STATUS) - sizeof (Db->TxBuffer)) + sizeof (Db->TxBuffer[0]));\r
-\r
+  Snp->Cdb.DBsize     = (UINT16) sizeof (PXE_DB_GET_STATUS);\r
   Snp->Cdb.DBaddr     = (UINT64)(UINTN) Db;\r
 \r
   Snp->Cdb.StatCode   = PXE_STATCODE_INITIALIZE;\r