Httpboot over Ipv4 or Ipv6 stack,for both Identity and chunked transfer
mode,when the last
data has been parsed by HttpLib, the HttpInstance->NextMsg pointer should point
a correct
location.Now after the first successful httpboot for ipv4 or ipv6,the
HttpInstance->NextMsg
point the character after the last byte, it may be a bad buffer if we don't
receive another
HttpHeader, so if call a 2nd httpboot, the wrong NextMsg pointer will cause the
httpboot
fail, so we need to check this case in HttpBodyParserCallback function in the
first http
boot process.
Cc: Fu Siyuan <siyuan...@intel.com>
Cc: Ye Ting <ting...@intel.com>
Cc: Wu Jiaxin <jiaxin...@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <lubo.zh...@intel.com>
---
NetworkPkg/HttpDxe/HttpImpl.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/NetworkPkg/HttpDxe/HttpImpl.c b/NetworkPkg/HttpDxe/HttpImpl.c
index 0fa437d..aee3de5 100644
--- a/NetworkPkg/HttpDxe/HttpImpl.c
+++ b/NetworkPkg/HttpDxe/HttpImpl.c
@@ -776,21 +776,30 @@ HttpBodyParserCallback (
IN UINTN Length,
IN VOID *Context
)
{
HTTP_TOKEN_WRAP *Wrap;
+ UINTN BodyLength;
+ CHAR8 *Body;
if (EventType != BodyParseEventOnComplete) {
return EFI_SUCCESS;
}
if (Data == NULL || Length != 0 || Context == NULL) {
return EFI_SUCCESS;
}
Wrap = (HTTP_TOKEN_WRAP *) Context;
- Wrap->HttpInstance->NextMsg = Data;
+ Body = Wrap->HttpToken->Message->Body;
+ BodyLength = Wrap->HttpToken->Message->BodyLength;
+ if (Data < Body + BodyLength) {
+ Wrap->HttpInstance->NextMsg = Data;
+ } else {
+ Wrap->HttpInstance->NextMsg = NULL;
+ }
+
//
// Free Tx4Token or Tx6Token since already received corrsponding HTTP
response.
//
FreePool (Wrap);
--
1.9.5.msysgit.1
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
