From ceec363801849327aba6d39b1a809f9a9272f3ce Mon Sep 17 00:00:00 2001
From: Wang Fan <fan.wang@intel.com>
Date: Wed, 3 Jan 2018 18:11:04 +0800
Subject: [PATCH] NetworkPkg: Add more parameter or return status check in UDP6
 driver

In UDP6Dxe, there are several places that may be enhanced
to check input parameters and returned status. This patch
is to fix these issues.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wang Fan <fan.wang@intel.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
---
 NetworkPkg/Udp6Dxe/Udp6Driver.c | 48 ++++++++++++++++++---------------
 NetworkPkg/Udp6Dxe/Udp6Impl.c   | 17 ++++++++++++
 NetworkPkg/Udp6Dxe/Udp6Main.c   |  2 +-
 3 files changed, 45 insertions(+), 22 deletions(-)

diff --git a/NetworkPkg/Udp6Dxe/Udp6Driver.c b/NetworkPkg/Udp6Dxe/Udp6Driver.c
index 6dde1fc07e..f9d528e68f 100644
--- a/NetworkPkg/Udp6Dxe/Udp6Driver.c
+++ b/NetworkPkg/Udp6Dxe/Udp6Driver.c
@@ -290,18 +290,15 @@ Udp6DriverBindingStop (
                NULL
                );
   } else if (IsListEmpty (&Udp6Service->ChildrenList)) {
-    gBS->UninstallMultipleProtocolInterfaces (
-           NicHandle,
-           &gEfiUdp6ServiceBindingProtocolGuid,
-           &Udp6Service->ServiceBinding,
-           NULL
-           );
+    Status = gBS->UninstallMultipleProtocolInterfaces (
+               NicHandle,
+               &gEfiUdp6ServiceBindingProtocolGuid,
+               &Udp6Service->ServiceBinding,
+               NULL
+               );
  
     Udp6CleanService (Udp6Service);
-
     FreePool (Udp6Service);
-
-    Status = EFI_SUCCESS;
   }
 
   return Status;
@@ -510,21 +507,30 @@ Udp6ServiceBindingDestroyChild (
   //
   // Close the Ip6 protocol on the default IpIo.
   //
-  gBS->CloseProtocol (
-         Udp6Service->IpIo->ChildHandle,
-         &gEfiIp6ProtocolGuid,
-         gUdp6DriverBinding.DriverBindingHandle,
-         Instance->ChildHandle
-         );
+  Status = gBS->CloseProtocol (
+             Udp6Service->IpIo->ChildHandle,
+             &gEfiIp6ProtocolGuid,
+             gUdp6DriverBinding.DriverBindingHandle,
+             Instance->ChildHandle
+             );
+  if (EFI_ERROR (Status)) {
+    Instance->InDestroy = FALSE;
+    return Status;
+  }
+
   //
   // Close the Ip6 protocol on this instance's IpInfo.
   //
-  gBS->CloseProtocol (
-         Instance->IpInfo->ChildHandle,
-         &gEfiIp6ProtocolGuid,
-         gUdp6DriverBinding.DriverBindingHandle,
-         Instance->ChildHandle
-         );
+  Status = gBS->CloseProtocol (
+             Instance->IpInfo->ChildHandle,
+             &gEfiIp6ProtocolGuid,
+             gUdp6DriverBinding.DriverBindingHandle,
+             Instance->ChildHandle
+             );
+  if (EFI_ERROR (Status)) {
+    Instance->InDestroy = FALSE;
+    return Status;
+  }
 
   //
   // Uninstall the Udp6Protocol previously installed on the ChildHandle.
diff --git a/NetworkPkg/Udp6Dxe/Udp6Impl.c b/NetworkPkg/Udp6Dxe/Udp6Impl.c
index 458470ce2c..d014e2dcbc 100644
--- a/NetworkPkg/Udp6Dxe/Udp6Impl.c
+++ b/NetworkPkg/Udp6Dxe/Udp6Impl.c
@@ -57,6 +57,9 @@ Udp6FindInstanceByPort (
   interface. It's called to signal the udp TxToken when the IpIo layer completes
   transmitting of the udp datagram.
 
+  If Context is NULL, then ASSERT().
+  If NotifyData is NULL, then ASSERT().
+
   @param[in]  Status            The completion status of the output udp datagram.
   @param[in]  Context           Pointer to the context data.
   @param[in]  Sender            Specify a EFI_IP6_PROTOCOL for sending.
@@ -75,6 +78,10 @@ Udp6DgramSent (
 /**
   This function processes the received datagram passed up by the IpIo layer.
 
+  If NetSession is NULL, then ASSERT().
+  If Packet is NULL, then ASSERT().
+  If Context is NULL, then ASSERT().
+
   @param[in]  Status            The status of this udp datagram.
   @param[in]  IcmpError         The IcmpError code, only available when Status is
                                 EFI_ICMP_ERROR.
@@ -977,6 +984,9 @@ Udp6RemoveToken (
   interface. It's called to signal the udp TxToken when IpIo layer completes the
   transmitting of the udp datagram.
 
+  If Context is NULL, then ASSERT().
+  If NotifyData is NULL, then ASSERT().
+
   @param[in]  Status            The completion status of the output udp datagram.
   @param[in]  Context           Pointer to the context data.
   @param[in]  Sender            Specify a EFI_IP6_PROTOCOL for sending.
@@ -995,6 +1005,8 @@ Udp6DgramSent (
   UDP6_INSTANCE_DATA         *Instance;
   EFI_UDP6_COMPLETION_TOKEN  *Token;
 
+  ASSERT (Context != NULL && NotifyData != NULL);
+
   Instance = (UDP6_INSTANCE_DATA *) Context;
   Token    = (EFI_UDP6_COMPLETION_TOKEN *) NotifyData;
 
@@ -1012,6 +1024,10 @@ Udp6DgramSent (
 /**
   This function processes the received datagram passed up by the IpIo layer.
 
+  If NetSession is NULL, then ASSERT().
+  If Packet is NULL, then ASSERT().
+  If Context is NULL, then ASSERT().
+
   @param[in]  Status            The status of this udp datagram.
   @param[in]  IcmpError         The IcmpError code, only available when Status is
                                 EFI_ICMP_ERROR.
@@ -1031,6 +1047,7 @@ Udp6DgramRcvd (
   IN VOID                  *Context
   )
 {
+  ASSERT (NetSession != NULL && Packet != NULL && Context != NULL);
   NET_CHECK_SIGNATURE (Packet, NET_BUF_SIGNATURE);
 
   //
diff --git a/NetworkPkg/Udp6Dxe/Udp6Main.c b/NetworkPkg/Udp6Dxe/Udp6Main.c
index 53145c38be..1d7f0acbc7 100644
--- a/NetworkPkg/Udp6Dxe/Udp6Main.c
+++ b/NetworkPkg/Udp6Dxe/Udp6Main.c
@@ -381,7 +381,7 @@ Udp6Groups (
     Status = NetMapInsertTail (&Instance->McastIps, (VOID *) McastIp, NULL);
   } else {
 
-    NetMapIterate (&Instance->McastIps, Udp6LeaveGroup, MulticastAddress);
+    Status = NetMapIterate (&Instance->McastIps, Udp6LeaveGroup, MulticastAddress);
   }
 
 ON_EXIT:
-- 
2.39.2