[edk2] [Patch] NetworkPkg: Fix incorrect buffer free in HttpDxe

[Jiaxin Wu]

FragmentBuffer of each TcpWrap in HttpDxe should not be
freed in HttpTcpTokenCleanup(). This buffer points to
HttpMsg body actually, which is the responsibility of the
caller to allocate a buffer for Body.

Cc: Ye Ting <ting...@intel.com>
Cc: Fu Siyuan <siyuan...@intel.com>
Cc: Zhang Lubo <lubo.zh...@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin...@intel.com>
---
 NetworkPkg/HttpDxe/HttpProto.c | 44 +++++++++++++++++++++---------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/NetworkPkg/HttpDxe/HttpProto.c b/NetworkPkg/HttpDxe/HttpProto.c
index 9b3c774..bd95c0d 100644
--- a/NetworkPkg/HttpDxe/HttpProto.c
+++ b/NetworkPkg/HttpDxe/HttpProto.c
@@ -1796,49 +1796,49 @@ HttpTcpTokenCleanup (
   HttpInstance   = Wrap->HttpInstance;
   Rx4Token       = NULL;
   Rx6Token       = NULL;
   
   if (HttpInstance->LocalAddressIsIPv6) {
-    if (Wrap->TcpWrap.Rx6Token.CompletionToken.Event != NULL) {
-      gBS->CloseEvent (Wrap->TcpWrap.Rx6Token.CompletionToken.Event);
-    }
-
     Rx6Token = &Wrap->TcpWrap.Rx6Token;
-    if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
-      FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
-      Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
+    
+    if (Rx6Token->CompletionToken.Event != NULL) {
+      gBS->CloseEvent (Rx6Token->CompletionToken.Event);
+      Rx6Token->CompletionToken.Event = NULL;
     }
-    FreePool (Wrap);
 
-    if (HttpInstance->Rx6Token.CompletionToken.Event != NULL) {
-      gBS->CloseEvent (HttpInstance->Rx6Token.CompletionToken.Event);
-      HttpInstance->Rx6Token.CompletionToken.Event = NULL;
-    }
+    FreePool (Wrap);
 
     Rx6Token = &HttpInstance->Rx6Token;
+    
+    if (Rx6Token->CompletionToken.Event != NULL) {
+      gBS->CloseEvent (Rx6Token->CompletionToken.Event);
+      Rx6Token->CompletionToken.Event = NULL;
+    }
+    
     if (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
       FreePool (Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
       Rx6Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
     }
     
   } else {
-    if (Wrap->TcpWrap.Rx4Token.CompletionToken.Event != NULL) {
-      gBS->CloseEvent (Wrap->TcpWrap.Rx4Token.CompletionToken.Event);
-    }
     Rx4Token = &Wrap->TcpWrap.Rx4Token;
-    if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
-      FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
-      Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
+  
+    if (Rx4Token->CompletionToken.Event != NULL) {
+      gBS->CloseEvent (Rx4Token->CompletionToken.Event);
+      Rx4Token->CompletionToken.Event = NULL;
     }
+    
     FreePool (Wrap);
 
-    if (HttpInstance->Rx4Token.CompletionToken.Event != NULL) {
-      gBS->CloseEvent (HttpInstance->Rx4Token.CompletionToken.Event);
-      HttpInstance->Rx4Token.CompletionToken.Event = NULL;
+    Rx4Token = &HttpInstance->Rx4Token;
+
+    if (Rx4Token->CompletionToken.Event != NULL) {
+      gBS->CloseEvent (Rx4Token->CompletionToken.Event);
+      Rx4Token->CompletionToken.Event = NULL;
     }
     
-    Rx4Token = &HttpInstance->Rx4Token;
+    
     if (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer != NULL) {
       FreePool (Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer);
       Rx4Token->Packet.RxData->FragmentTable[0].FragmentBuffer = NULL;
     }
   }
-- 
1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel