The HostNameToIp() is a asynchronous function, so the caller
may free the HostName buffer immediately once HostNameToIp()
is returned. Then DNS driver may access the freed memory buffer
later.
This patch is to fix above issue.
Cc: Ye Ting <ting...@intel.com>
Cc: Fu Siyuan <siyuan...@intel.com>
Cc: Wang Fan <fan.w...@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin...@intel.com>
---
NetworkPkg/DnsDxe/DnsProtocol.c | 69 +++++++++++++++++++++++------------------
1 file changed, 39 insertions(+), 30 deletions(-)
diff --git a/NetworkPkg/DnsDxe/DnsProtocol.c b/NetworkPkg/DnsDxe/DnsProtocol.c
index df737dc..1fcaabd 100644
--- a/NetworkPkg/DnsDxe/DnsProtocol.c
+++ b/NetworkPkg/DnsDxe/DnsProtocol.c
@@ -462,13 +462,19 @@ Dns4HostNameToIp (
Status = EFI_OUT_OF_RESOURCES;
goto ON_EXIT;
}
TokenEntry->PacketToLive = Token->RetryInterval;
- TokenEntry->QueryHostName = HostName;
TokenEntry->Token = Token;
-
+ TokenEntry->QueryHostName = AllocateZeroPool (StrSize (HostName));
+ if (TokenEntry->QueryHostName == NULL) {
+ Status = EFI_OUT_OF_RESOURCES;
+ goto ON_EXIT;
+ }
+
+ CopyMem (TokenEntry->QueryHostName, HostName, StrSize (HostName));
+
//
// Construct QName.
//
QueryName = NetLibCreateDnsQName (TokenEntry->QueryHostName);
if (QueryName == NULL) {
@@ -478,49 +484,48 @@ Dns4HostNameToIp (
//
// Construct DNS Query Packet.
//
Status = ConstructDNSQuery (Instance, QueryName, DNS_TYPE_A, DNS_CLASS_INET,
&Packet);
- if (EFI_ERROR (Status)) {
- if (TokenEntry != NULL) {
- FreePool (TokenEntry);
- }
-
+ if (EFI_ERROR (Status)) {
goto ON_EXIT;
}
ASSERT (Packet != NULL);
//
// Save the token into the Dns4TxTokens map.
//
Status = NetMapInsertTail (&Instance->Dns4TxTokens, TokenEntry, Packet);
if (EFI_ERROR (Status)) {
- if (TokenEntry != NULL) {
- FreePool (TokenEntry);
- }
-
- NetbufFree (Packet);
-
goto ON_EXIT;
}
//
// Dns Query Ip
//
Status = DoDnsQuery (Instance, Packet);
if (EFI_ERROR (Status)) {
Dns4RemoveTokenEntry (&Instance->Dns4TxTokens, TokenEntry);
+ }
+
+ON_EXIT:
+ if (EFI_ERROR (Status)) {
if (TokenEntry != NULL) {
+ if (TokenEntry->QueryHostName != NULL) {
+ FreePool (TokenEntry->QueryHostName);
+ }
+
FreePool (TokenEntry);
}
- NetbufFree (Packet);
+ if (Packet != NULL) {
+ NetbufFree (Packet);
+ }
}
-ON_EXIT:
if (QueryName != NULL) {
FreePool (QueryName);
}
gBS->RestoreTPL (OldTpl);
@@ -1299,13 +1304,18 @@ Dns6HostNameToIp (
Status = EFI_OUT_OF_RESOURCES;
goto ON_EXIT;
}
TokenEntry->PacketToLive = Token->RetryInterval;
- TokenEntry->QueryHostName = HostName;
TokenEntry->Token = Token;
-
+ TokenEntry->QueryHostName = AllocateZeroPool (StrSize (HostName));
+ if (TokenEntry->QueryHostName == NULL) {
+ Status = EFI_OUT_OF_RESOURCES;
+ goto ON_EXIT;
+ }
+
+ CopyMem (TokenEntry->QueryHostName, HostName, StrSize (HostName));
//
// Construct QName.
//
QueryName = NetLibCreateDnsQName (TokenEntry->QueryHostName);
@@ -1317,48 +1327,47 @@ Dns6HostNameToIp (
//
// Construct DNS Query Packet.
//
Status = ConstructDNSQuery (Instance, QueryName, DNS_TYPE_AAAA,
DNS_CLASS_INET, &Packet);
if (EFI_ERROR (Status)) {
- if (TokenEntry != NULL) {
- FreePool (TokenEntry);
- }
-
goto ON_EXIT;
}
ASSERT (Packet != NULL);
//
// Save the token into the Dns6TxTokens map.
//
Status = NetMapInsertTail (&Instance->Dns6TxTokens, TokenEntry, Packet);
if (EFI_ERROR (Status)) {
- if (TokenEntry != NULL) {
- FreePool (TokenEntry);
- }
-
- NetbufFree (Packet);
-
goto ON_EXIT;
}
//
// Dns Query Ip
//
Status = DoDnsQuery (Instance, Packet);
if (EFI_ERROR (Status)) {
Dns6RemoveTokenEntry (&Instance->Dns6TxTokens, TokenEntry);
-
+ }
+
+ON_EXIT:
+
+ if (EFI_ERROR (Status)) {
if (TokenEntry != NULL) {
+ if (TokenEntry->QueryHostName != NULL) {
+ FreePool (TokenEntry->QueryHostName);
+ }
+
FreePool (TokenEntry);
}
- NetbufFree (Packet);
+ if (Packet != NULL) {
+ NetbufFree (Packet);
+ }
}
-ON_EXIT:
if (QueryName != NULL) {
FreePool (QueryName);
}
gBS->RestoreTPL (OldTpl);
--
1.9.5.msysgit.1
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
