Fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235 Signed-off-by: yexiao <yexiao7@huawei.com> (cherry picked from commit 0d783883a080866aaf39b712c35450263c70a772)
156 lines
4.7 KiB
Diff
156 lines
4.7 KiB
Diff
From ecabbf511f63b6149b65752bdae881a817f43b47 Mon Sep 17 00:00:00 2001
|
|
From: Doug Flick <dougflick@microsoft.com>
|
|
Date: Tue, 13 Feb 2024 10:46:01 -0800
|
|
Subject: [PATCH 2/3] NetworkPkg: Dhcp6Dxe: Removes duplicate check and
|
|
replaces with macro
|
|
|
|
Removes duplicate check after merge
|
|
|
|
>
|
|
> //
|
|
> // Verify the PacketCursor is within the packet
|
|
> //
|
|
> if ( (*PacketCursor < Packet->Dhcp6.Option)
|
|
> || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size -
|
|
sizeof (EFI_DHCP6_HEADER))))
|
|
> {
|
|
> return EFI_INVALID_PARAMETER;
|
|
> }
|
|
>
|
|
|
|
Converts the check to a macro and replaces all instances of the check
|
|
with the macro
|
|
|
|
Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
|
|
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
|
|
Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
|
|
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
|
|
Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
|
|
|
|
reference: https://github.com/tianocore/edk2/pull/5372
|
|
Signed-off-by: yexiao <yexiao7@huawei.com>
|
|
---
|
|
NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c | 46 ++++++++++++------------------
|
|
1 file changed, 19 insertions(+), 27 deletions(-)
|
|
|
|
diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
|
|
index 442ecc7a..dbfbd925 100644
|
|
--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
|
|
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
|
|
@@ -10,6 +10,14 @@
|
|
|
|
#include "Dhcp6Impl.h"
|
|
|
|
+//
|
|
+// Verifies the packet cursor is within the packet
|
|
+// otherwise it is invalid
|
|
+//
|
|
+#define IS_INVALID_PACKET_CURSOR(PacketCursor, Packet) \
|
|
+ (((*PacketCursor) < (Packet)->Dhcp6.Option) || \
|
|
+ ((*PacketCursor) >= (Packet)->Dhcp6.Option + ((Packet)->Size - sizeof(EFI_DHCP6_HEADER))) \
|
|
+ )
|
|
|
|
/**
|
|
Generate client Duid in the format of Duid-llt.
|
|
@@ -662,9 +670,7 @@ Dhcp6AppendOption (
|
|
//
|
|
// Verify the PacketCursor is within the packet
|
|
//
|
|
- if ( (*PacketCursor < Packet->Dhcp6.Option)
|
|
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
|
|
- {
|
|
+ if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
|
|
return EFI_INVALID_PARAMETER;
|
|
}
|
|
|
|
@@ -681,15 +687,6 @@ Dhcp6AppendOption (
|
|
return EFI_BUFFER_TOO_SMALL;
|
|
}
|
|
|
|
- //
|
|
- // Verify the PacketCursor is within the packet
|
|
- //
|
|
- if ( (*PacketCursor < Packet->Dhcp6.Option)
|
|
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
|
|
- {
|
|
- return EFI_INVALID_PARAMETER;
|
|
- }
|
|
-
|
|
WriteUnaligned16 ((UINT16 *)*PacketCursor, OptType);
|
|
*PacketCursor += DHCP6_SIZE_OF_OPT_CODE;
|
|
WriteUnaligned16 ((UINT16 *)*PacketCursor, OptLen);
|
|
@@ -768,9 +765,7 @@ Dhcp6AppendIaAddrOption (
|
|
//
|
|
// Verify the PacketCursor is within the packet
|
|
//
|
|
- if ( (*PacketCursor < Packet->Dhcp6.Option)
|
|
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
|
|
- {
|
|
+ if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
|
|
return EFI_INVALID_PARAMETER;
|
|
}
|
|
|
|
@@ -900,9 +895,7 @@ Dhcp6AppendIaOption (
|
|
//
|
|
// Verify the PacketCursor is within the packet
|
|
//
|
|
- if ( (*PacketCursor < Packet->Dhcp6.Option)
|
|
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
|
|
- {
|
|
+ if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
|
|
return EFI_INVALID_PARAMETER;
|
|
}
|
|
|
|
@@ -964,15 +957,15 @@ Dhcp6AppendIaOption (
|
|
}
|
|
}
|
|
|
|
- //
|
|
- // Fill the value of Ia option length
|
|
- //
|
|
- *Len = HTONS ((UINT16)(*PacketCursor - (UINT8 *)Len - 2));
|
|
-
|
|
//
|
|
// Update the packet length
|
|
//
|
|
Packet->Length += BytesNeeded;
|
|
+
|
|
+ //
|
|
+ // Fill the value of Ia option length
|
|
+ //
|
|
+ *Len = HTONS ((UINT16)(*PacketCursor - (UINT8 *)Len - 2));
|
|
|
|
return EFI_SUCCESS;
|
|
}
|
|
@@ -981,6 +974,7 @@ Dhcp6AppendIaOption (
|
|
Append the appointed Elapsed time option to Buf, and move Buf to the end.
|
|
|
|
@param[in, out] Packet A pointer to the packet, on success Packet->Length
|
|
+ will be updated.
|
|
@param[in, out] PacketCursor The pointer in the packet, on success PacketCursor
|
|
will be moved to the end of the option.
|
|
@param[in] Instance The pointer to the Dhcp6 instance.
|
|
@@ -1036,9 +1030,7 @@ Dhcp6AppendETOption (
|
|
//
|
|
// Verify the PacketCursor is within the packet
|
|
//
|
|
- if ( (*PacketCursor < Packet->Dhcp6.Option)
|
|
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
|
|
- {
|
|
+ if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
|
|
return EFI_INVALID_PARAMETER;
|
|
}
|
|
|
|
@@ -1074,7 +1066,7 @@ Dhcp6AppendETOption (
|
|
WriteUnaligned16 ((UINT16 *)*PacketCursor, HTONS (0));
|
|
*Elapsed = (UINT16 *)*PacketCursor;
|
|
*PacketCursor += sizeof (UINT16);
|
|
-
|
|
+
|
|
Packet->Length += BytesNeeded;
|
|
|
|
return EFI_SUCCESS;
|
|
--
|
|
2.33.0
|
|
|