hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-14 22:32:30 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

stand/efihttp: Work around a bug in edk2 http instance reconfiguration

Browse Source 
A bug in the EFI HTTP driver of TianoCore EDK2 causes memory
corruption when an http instance that uses tls is reconfigured,
leading to a crash.

Work around this by forcing a new http instance for each request
instead of reconfiguring the existing one.

The upstream bug report is https://bugzilla.tianocore.org/show_bug.cgi?id=1917

Submitted by:	bcran
Reviewed By:	imp, kevans, tsoome
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D21281
This commit is contained in:
D Scott Phillips 2020-09-09 16:35:51 +00:00
parent 022c2f5570
commit d455cd5ac3
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=365505
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
stand/efi/libefi/efihttp.c
View File

@ -576,6 +576,14 @@ efihttp_fs_open(const char *path, struct open_file *f)
*/ */
err = _efihttp_fs_open(path, f); err = _efihttp_fs_open(path, f);
if (err != 0) { if (err != 0) {
/*
* Work around a bug in the EFI HTTP implementation which
* causes a crash if the http instance isn't torn down
* between requests.
* See https://bugzilla.tianocore.org/show_bug.cgi?id=1917
*/
efihttp_dev_close(f);
efihttp_dev_open(f);
path_slash = malloc(strlen(path) + 2); path_slash = malloc(strlen(path) + 2);
if (path_slash == NULL) if (path_slash == NULL)
return (ENOMEM); return (ENOMEM);
@ -719,6 +727,14 @@ efihttp_fs_seek(struct open_file *f, off_t offset, int where)
path = fh->path; path = fh->path;
fh->path = NULL; fh->path = NULL;
efihttp_fs_close(f); efihttp_fs_close(f);
/*
* Work around a bug in the EFI HTTP implementation which
* causes a crash if the http instance isn't torn down
* between requests.
* See https://bugzilla.tianocore.org/show_bug.cgi?id=1917
*/
efihttp_dev_close(f);
efihttp_dev_open(f);
err = efihttp_fs_open(path, f); err = efihttp_fs_open(path, f);
free(path); free(path);
if (err != 0) if (err != 0)