sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

NetworkPkg: Fix incorrect buffer free in HttpDxe

Browse Source 
FragmentBuffer of each TcpWrap in HttpDxe should not be
freed in HttpTcpTokenCleanup(). This buffer points to
HttpMsg body actually, which is the responsibility of the
caller to allocate a buffer for Body.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Zhang Lubo <lubo.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
This commit is contained in:
Jiaxin Wu
2016-04-27 14:29:29 +08:00
parent b347a22aec
commit 59844e1266
1 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
NetworkPkg/HttpDxe/HttpProto.c
View File

@ -1837,45 +1837,45 @@ HttpTcpTokenCleanup (
Rx6Token = NULL; Rx6Token = NULL;
if (HttpInstance->LocalAddressIsIPv6) { if (HttpInstance->LocalAddressIsIPv6) {
if (Wrap->TcpWrap.Rx6Token.CompletionToken.Event != NULL) { Rx6Token = &Wrap->TcpWrap.Rx6Token;
gBS->CloseEvent (Wrap->TcpWrap.Rx6Token.CompletionToken.Event);
if (Rx6Token->CompletionToken.Event != NULL) {
gBS->CloseEvent (Rx6Token->CompletionToken.Event);
Rx6Token->CompletionToken.Event = NULL;
} }
Rx6Token = &Wrap->TcpWrap.Rx6Token;
if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
}
FreePool (Wrap); FreePool (Wrap);
if (HttpInstance->Rx6Token.CompletionToken.Event != NULL) { Rx6Token = &HttpInstance->Rx6Token;
gBS->CloseEvent (HttpInstance->Rx6Token.CompletionToken.Event);
HttpInstance->Rx6Token.CompletionToken.Event = NULL; if (Rx6Token->CompletionToken.Event != NULL) {
gBS->CloseEvent (Rx6Token->CompletionToken.Event);
Rx6Token->CompletionToken.Event = NULL;
} }
Rx6Token = &HttpInstance->Rx6Token;
if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) { if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer); FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL; Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
} }
} else { } else {
if (Wrap->TcpWrap.Rx4Token.CompletionToken.Event != NULL) {
gBS->CloseEvent (Wrap->TcpWrap.Rx4Token.CompletionToken.Event);
}
Rx4Token = &Wrap->TcpWrap.Rx4Token; Rx4Token = &Wrap->TcpWrap.Rx4Token;
if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer); if (Rx4Token->CompletionToken.Event != NULL) {
Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL; gBS->CloseEvent (Rx4Token->CompletionToken.Event);
Rx4Token->CompletionToken.Event = NULL;
} }
FreePool (Wrap); FreePool (Wrap);
if (HttpInstance->Rx4Token.CompletionToken.Event != NULL) { Rx4Token = &HttpInstance->Rx4Token;
gBS->CloseEvent (HttpInstance->Rx4Token.CompletionToken.Event);
HttpInstance->Rx4Token.CompletionToken.Event = NULL; if (Rx4Token->CompletionToken.Event != NULL) {
gBS->CloseEvent (Rx4Token->CompletionToken.Event);
Rx4Token->CompletionToken.Event = NULL;
} }
Rx4Token = &HttpInstance->Rx4Token;
if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) { if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer); FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL; Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;