From nobody Sat Feb 7 07:11:34 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1512457182824877.9112087113524; Mon, 4 Dec 2017 22:59:42 -0800 (PST) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id BE10620356269; Mon, 4 Dec 2017 22:55:07 -0800 (PST) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id E795E20356268 for ; Mon, 4 Dec 2017 22:55:06 -0800 (PST) Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 04 Dec 2017 22:59:37 -0800 Received: from jiaxinwu-mobl2.ccr.corp.intel.com ([10.239.196.96]) by orsmga008.jf.intel.com with ESMTP; 04 Dec 2017 22:59:36 -0800 X-Original-To: edk2-devel@lists.01.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.20; helo=mga02.intel.com; envelope-from=jiaxin.wu@intel.com; receiver=edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,363,1508828400"; d="scan'208";a="157599" From: Jiaxin Wu To: edk2-devel@lists.01.org Date: Tue, 5 Dec 2017 14:59:22 +0800 Message-Id: <1512457162-9296-5-git-send-email-jiaxin.wu@intel.com> X-Mailer: git-send-email 1.9.5.msysgit.1 In-Reply-To: <1512457162-9296-1-git-send-email-jiaxin.wu@intel.com> References: <1512457162-9296-1-git-send-email-jiaxin.wu@intel.com> Subject: [edk2] [Patch 4/4] NetworkPkg/DnsDxe: Avoid to access the freed memory buffer. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Ye Ting , Wang Fan , Fu Siyuan , Wu Jiaxin MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" The HostNameToIp() is a asynchronous function, so the caller may free the HostName buffer immediately once HostNameToIp() is returned. Then DNS driver may access the freed memory buffer later. This patch is to fix above issue. Cc: Ye Ting Cc: Fu Siyuan Cc: Wang Fan Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin --- NetworkPkg/DnsDxe/DnsProtocol.c | 69 +++++++++++++++++++++++--------------= ---- 1 file changed, 39 insertions(+), 30 deletions(-) diff --git a/NetworkPkg/DnsDxe/DnsProtocol.c b/NetworkPkg/DnsDxe/DnsProtoco= l.c index df737dc..1fcaabd 100644 --- a/NetworkPkg/DnsDxe/DnsProtocol.c +++ b/NetworkPkg/DnsDxe/DnsProtocol.c @@ -462,13 +462,19 @@ Dns4HostNameToIp ( Status =3D EFI_OUT_OF_RESOURCES; goto ON_EXIT; } =20 TokenEntry->PacketToLive =3D Token->RetryInterval; - TokenEntry->QueryHostName =3D HostName; TokenEntry->Token =3D Token; - + TokenEntry->QueryHostName =3D AllocateZeroPool (StrSize (HostName)); + if (TokenEntry->QueryHostName =3D=3D NULL) { + Status =3D EFI_OUT_OF_RESOURCES; + goto ON_EXIT; + } + =20 + CopyMem (TokenEntry->QueryHostName, HostName, StrSize (HostName)); + =20 // // Construct QName. // QueryName =3D NetLibCreateDnsQName (TokenEntry->QueryHostName); if (QueryName =3D=3D NULL) { @@ -478,49 +484,48 @@ Dns4HostNameToIp ( =20 // // Construct DNS Query Packet. // Status =3D ConstructDNSQuery (Instance, QueryName, DNS_TYPE_A, DNS_CLASS= _INET, &Packet); - if (EFI_ERROR (Status)) { - if (TokenEntry !=3D NULL) { - FreePool (TokenEntry); - } - =20 + if (EFI_ERROR (Status)) {=20 goto ON_EXIT; } =20 ASSERT (Packet !=3D NULL); =20 // // Save the token into the Dns4TxTokens map. // Status =3D NetMapInsertTail (&Instance->Dns4TxTokens, TokenEntry, Packet= ); if (EFI_ERROR (Status)) { - if (TokenEntry !=3D NULL) { - FreePool (TokenEntry); - } - =20 - NetbufFree (Packet); - =20 goto ON_EXIT; } =20 // // Dns Query Ip // Status =3D DoDnsQuery (Instance, Packet); if (EFI_ERROR (Status)) { Dns4RemoveTokenEntry (&Instance->Dns4TxTokens, TokenEntry); + } + =20 +ON_EXIT: =20 + if (EFI_ERROR (Status)) { if (TokenEntry !=3D NULL) { + if (TokenEntry->QueryHostName !=3D NULL) { + FreePool (TokenEntry->QueryHostName); + } + =20 FreePool (TokenEntry); } =20 - NetbufFree (Packet); + if (Packet !=3D NULL) { + NetbufFree (Packet); + } } =20 -ON_EXIT: if (QueryName !=3D NULL) { FreePool (QueryName); } =20 gBS->RestoreTPL (OldTpl); @@ -1299,13 +1304,18 @@ Dns6HostNameToIp ( Status =3D EFI_OUT_OF_RESOURCES; goto ON_EXIT; } =20 TokenEntry->PacketToLive =3D Token->RetryInterval; - TokenEntry->QueryHostName =3D HostName; TokenEntry->Token =3D Token; - + TokenEntry->QueryHostName =3D AllocateZeroPool (StrSize (HostName)); + if (TokenEntry->QueryHostName =3D=3D NULL) { + Status =3D EFI_OUT_OF_RESOURCES; + goto ON_EXIT; + } + =20 + CopyMem (TokenEntry->QueryHostName, HostName, StrSize (HostName)); =20 // // Construct QName. // QueryName =3D NetLibCreateDnsQName (TokenEntry->QueryHostName); @@ -1317,48 +1327,47 @@ Dns6HostNameToIp ( // // Construct DNS Query Packet. // Status =3D ConstructDNSQuery (Instance, QueryName, DNS_TYPE_AAAA, DNS_CL= ASS_INET, &Packet); if (EFI_ERROR (Status)) { - if (TokenEntry !=3D NULL) { - FreePool (TokenEntry); - } - =20 goto ON_EXIT; } =20 ASSERT (Packet !=3D NULL); =20 // // Save the token into the Dns6TxTokens map. // Status =3D NetMapInsertTail (&Instance->Dns6TxTokens, TokenEntry, Packet= ); if (EFI_ERROR (Status)) { - if (TokenEntry !=3D NULL) { - FreePool (TokenEntry); - } - =20 - NetbufFree (Packet); - =20 goto ON_EXIT; } =20 // // Dns Query Ip // Status =3D DoDnsQuery (Instance, Packet); if (EFI_ERROR (Status)) { Dns6RemoveTokenEntry (&Instance->Dns6TxTokens, TokenEntry); - =20 + } + =20 +ON_EXIT: + + if (EFI_ERROR (Status)) { if (TokenEntry !=3D NULL) { + if (TokenEntry->QueryHostName !=3D NULL) { + FreePool (TokenEntry->QueryHostName); + } + =20 FreePool (TokenEntry); } =20 - NetbufFree (Packet); + if (Packet !=3D NULL) { + NetbufFree (Packet); + } } =20 -ON_EXIT: if (QueryName !=3D NULL) { FreePool (QueryName); } =20 gBS->RestoreTPL (OldTpl); --=20 1.9.5.msysgit.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel