edk2/0081-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch
yexiao d4ed40f9e7 Fix some CVE
Fix CVE-2023-45229、CVE-2023-45230、CVE-2023-45231、CVE-2023-45232、CVE-2023-45233、CVE-2023-45234、CVE-2023-45235

Signed-off-by: yexiao <yexiao7@huawei.com>
(cherry picked from commit 0d783883a080866aaf39b712c35450263c70a772)
2024-03-08 17:08:49 +08:00

156 lines
4.7 KiB
Diff

From ecabbf511f63b6149b65752bdae881a817f43b47 Mon Sep 17 00:00:00 2001
From: Doug Flick <dougflick@microsoft.com>
Date: Tue, 13 Feb 2024 10:46:01 -0800
Subject: [PATCH 2/3] NetworkPkg: Dhcp6Dxe: Removes duplicate check and
replaces with macro
Removes duplicate check after merge
>
> //
> // Verify the PacketCursor is within the packet
> //
> if ( (*PacketCursor < Packet->Dhcp6.Option)
> || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size -
sizeof (EFI_DHCP6_HEADER))))
> {
> return EFI_INVALID_PARAMETER;
> }
>
Converts the check to a macro and replaces all instances of the check
with the macro
Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
reference: https://github.com/tianocore/edk2/pull/5372
Signed-off-by: yexiao <yexiao7@huawei.com>
---
NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c | 46 ++++++++++++------------------
1 file changed, 19 insertions(+), 27 deletions(-)
diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
index 442ecc7a..dbfbd925 100644
--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
@@ -10,6 +10,14 @@
#include "Dhcp6Impl.h"
+//
+// Verifies the packet cursor is within the packet
+// otherwise it is invalid
+//
+#define IS_INVALID_PACKET_CURSOR(PacketCursor, Packet) \
+ (((*PacketCursor) < (Packet)->Dhcp6.Option) || \
+ ((*PacketCursor) >= (Packet)->Dhcp6.Option + ((Packet)->Size - sizeof(EFI_DHCP6_HEADER))) \
+ )
/**
Generate client Duid in the format of Duid-llt.
@@ -662,9 +670,7 @@ Dhcp6AppendOption (
//
// Verify the PacketCursor is within the packet
//
- if ( (*PacketCursor < Packet->Dhcp6.Option)
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
- {
+ if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
return EFI_INVALID_PARAMETER;
}
@@ -681,15 +687,6 @@ Dhcp6AppendOption (
return EFI_BUFFER_TOO_SMALL;
}
- //
- // Verify the PacketCursor is within the packet
- //
- if ( (*PacketCursor < Packet->Dhcp6.Option)
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
- {
- return EFI_INVALID_PARAMETER;
- }
-
WriteUnaligned16 ((UINT16 *)*PacketCursor, OptType);
*PacketCursor += DHCP6_SIZE_OF_OPT_CODE;
WriteUnaligned16 ((UINT16 *)*PacketCursor, OptLen);
@@ -768,9 +765,7 @@ Dhcp6AppendIaAddrOption (
//
// Verify the PacketCursor is within the packet
//
- if ( (*PacketCursor < Packet->Dhcp6.Option)
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
- {
+ if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
return EFI_INVALID_PARAMETER;
}
@@ -900,9 +895,7 @@ Dhcp6AppendIaOption (
//
// Verify the PacketCursor is within the packet
//
- if ( (*PacketCursor < Packet->Dhcp6.Option)
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
- {
+ if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
return EFI_INVALID_PARAMETER;
}
@@ -964,15 +957,15 @@ Dhcp6AppendIaOption (
}
}
- //
- // Fill the value of Ia option length
- //
- *Len = HTONS ((UINT16)(*PacketCursor - (UINT8 *)Len - 2));
-
//
// Update the packet length
//
Packet->Length += BytesNeeded;
+
+ //
+ // Fill the value of Ia option length
+ //
+ *Len = HTONS ((UINT16)(*PacketCursor - (UINT8 *)Len - 2));
return EFI_SUCCESS;
}
@@ -981,6 +974,7 @@ Dhcp6AppendIaOption (
Append the appointed Elapsed time option to Buf, and move Buf to the end.
@param[in, out] Packet A pointer to the packet, on success Packet->Length
+ will be updated.
@param[in, out] PacketCursor The pointer in the packet, on success PacketCursor
will be moved to the end of the option.
@param[in] Instance The pointer to the Dhcp6 instance.
@@ -1036,9 +1030,7 @@ Dhcp6AppendETOption (
//
// Verify the PacketCursor is within the packet
//
- if ( (*PacketCursor < Packet->Dhcp6.Option)
- || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
- {
+ if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
return EFI_INVALID_PARAMETER;
}
@@ -1074,7 +1066,7 @@ Dhcp6AppendETOption (
WriteUnaligned16 ((UINT16 *)*PacketCursor, HTONS (0));
*Elapsed = (UINT16 *)*PacketCursor;
*PacketCursor += sizeof (UINT16);
-
+
Packet->Length += BytesNeeded;
return EFI_SUCCESS;
--
2.33.0