From nobody Sat May 10 23:25:34 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1514252042386238.35997214479664; Mon, 25 Dec 2017 17:34:02 -0800 (PST) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id C3BFC222CB320; Mon, 25 Dec 2017 17:29:06 -0800 (PST) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id EAB69222447D9 for ; Mon, 25 Dec 2017 17:29:03 -0800 (PST) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 25 Dec 2017 17:33:57 -0800 Received: from jiaxinwu-mobl2.ccr.corp.intel.com ([10.239.196.165]) by orsmga002.jf.intel.com with ESMTP; 25 Dec 2017 17:33:56 -0800 X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.65; helo=mga03.intel.com; envelope-from=jiaxin.wu@intel.com; receiver=edk2-devel@lists.01.org X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,457,1508828400"; d="scan'208";a="21327536" From: Jiaxin Wu To: edk2-devel@lists.01.org Date: Tue, 26 Dec 2017 09:33:47 +0800 Message-Id: <1514252029-12720-4-git-send-email-jiaxin.wu@intel.com> X-Mailer: git-send-email 1.9.5.msysgit.1 In-Reply-To: <1514252029-12720-1-git-send-email-jiaxin.wu@intel.com> References: <1514252029-12720-1-git-send-email-jiaxin.wu@intel.com> Subject: [edk2] [Patch 3/5] MdeModulePkg/DxeHttpLib: Check the input parameters for some APIs. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Ye Ting , Wang Fan , Fu Siyuan , Wu Jiaxin MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Cc: Ye Ting Cc: Fu Siyuan Cc: Wang Fan Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin --- MdeModulePkg/Include/Library/HttpLib.h | 1 + MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c | 25 ++++++++++++++++++++----- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/MdeModulePkg/Include/Library/HttpLib.h b/MdeModulePkg/Include/= Library/HttpLib.h index 8539820..88b56ae 100644 --- a/MdeModulePkg/Include/Library/HttpLib.h +++ b/MdeModulePkg/Include/Library/HttpLib.h @@ -370,10 +370,11 @@ HttpFindHeader ( @param[in] FieldName FieldName of this HttpHeader, a NULL= terminated ASCII string. @param[in] FieldValue FieldValue of this HttpHeader, a NUL= L terminated ASCII string. =20 =20 @retval EFI_SUCCESS The FieldName and FieldValue are set int= o HttpHeader successfully. + @retval EFI_INVALID_PARAMETER The parameter is invalid. @retval EFI_OUT_OF_RESOURCES Failed to allocate resources. =20 **/ EFI_STATUS EFIAPI diff --git a/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c b/MdeModulePkg/Li= brary/DxeHttpLib/DxeHttpLib.c index 27b94e3..38ded5d 100644 --- a/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c +++ b/MdeModulePkg/Library/DxeHttpLib/DxeHttpLib.c @@ -1396,10 +1396,14 @@ HttpIsMessageComplete ( IN VOID *MsgParser ) { HTTP_BODY_PARSER *Parser; =20 + if (MsgParser =3D=3D NULL) { + return FALSE; + } + Parser =3D (HTTP_BODY_PARSER*) MsgParser; =20 if (Parser->State =3D=3D BodyParserComplete) { return TRUE; } @@ -1497,10 +1501,11 @@ AsciiStrGetNextToken ( @param[in] FieldName FieldName of this HttpHeader, a NULL ter= minated ASCII string. @param[in] FieldValue FieldValue of this HttpHeader, a NULL te= rminated ASCII string. =20 =20 @retval EFI_SUCCESS The FieldName and FieldValue are set int= o HttpHeader successfully. + @retval EFI_INVALID_PARAMETER The parameter is invalid. @retval EFI_OUT_OF_RESOURCES Failed to allocate resources. =20 **/ EFI_STATUS EFIAPI @@ -1511,10 +1516,14 @@ HttpSetFieldNameAndValue ( ) { UINTN FieldNameSize; UINTN FieldValueSize; =20 + if (HttpHeader =3D=3D NULL || FieldName =3D=3D NULL || FieldValue =3D=3D= NULL) { + return EFI_INVALID_PARAMETER; + } + if (HttpHeader->FieldName !=3D NULL) { FreePool (HttpHeader->FieldName); } if (HttpHeader->FieldValue !=3D NULL) { FreePool (HttpHeader->FieldValue); @@ -1728,14 +1737,10 @@ HttpGenRequestMessage ( VOID *HttpHdr; EFI_HTTP_HEADER **AppendList; UINTN Index; EFI_HTTP_UTILITIES_PROTOCOL *HttpUtilitiesProtocol; =20 - - ASSERT (Message !=3D NULL); - - *RequestMsg =3D NULL; Status =3D EFI_SUCCESS; HttpHdrSize =3D 0; MsgSize =3D 0; Success =3D FALSE; HttpHdr =3D NULL; @@ -1746,11 +1751,12 @@ HttpGenRequestMessage ( // 1. If we have a Request, we cannot have a NULL Url // 2. If we have a Request, HeaderCount can not be non-zero // 3. If we do not have a Request, HeaderCount should be zero // 4. If we do not have Request and Headers, we need at least a message-= body // - if ((Message->Data.Request !=3D NULL && Url =3D=3D NULL) || + if ((Message =3D=3D NULL || RequestMsg =3D=3D NULL || RequestMsgSize =3D= =3D NULL) ||=20 + (Message->Data.Request !=3D NULL && Url =3D=3D NULL) || (Message->Data.Request !=3D NULL && Message->HeaderCount =3D=3D 0) || (Message->Data.Request =3D=3D NULL && Message->HeaderCount !=3D 0) || (Message->Data.Request =3D=3D NULL && Message->HeaderCount =3D=3D 0 = && Message->BodyLength =3D=3D 0)) { return EFI_INVALID_PARAMETER; } @@ -1827,10 +1833,11 @@ HttpGenRequestMessage ( MsgSize +=3D Message->BodyLength; =20 // // memory for the string that needs to be sent to TCP // + *RequestMsg =3D NULL; *RequestMsg =3D AllocateZeroPool (MsgSize); if (*RequestMsg =3D=3D NULL) { Status =3D EFI_OUT_OF_RESOURCES; goto Exit; } @@ -2052,11 +2059,19 @@ HttpIsValidHttpHeader ( IN CHAR8 *FieldName ) { UINTN Index; =20 + if (FieldName =3D=3D NULL) { + return FALSE; + } + for (Index =3D 0; Index < DeleteCount; Index++) { + if (DeleteList[Index] =3D=3D NULL) { + continue; + } + =20 if (AsciiStrCmp (FieldName, DeleteList[Index]) =3D=3D 0) { return FALSE; } } =20 --=20 1.9.5.msysgit.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel