apply 6.0.2 patchv6.0.2_rel

4 files changed, 42 insertions, 5 deletions

diff --git a/common/inc/nx_api.h b/common/inc/nx_api.h
index 49bbc8f7..4f021258 100644
--- a/common/inc/nx_api.h
+++ b/common/inc/nx_api.h
@@ -26,7 +26,7 @@
 /*  APPLICATION INTERFACE DEFINITION                       RELEASE        */
 /*                                                                        */
 /*    nx_api.h                                            PORTABLE C      */
-/*                                                           6.0.1        */
+/*                                                           6.0.2        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -49,6 +49,9 @@
 /*                                            ThreadX version check,      */
 /*                                            updated product constants,  */
 /*                                            resulting in version 6.0.1  */
+/*  08-14-2020     Yuxin Zhou               Modified comment(s), and      */
+/*                                            updated product constants,  */
+/*                                            resulting in version 6.0.2  */
 /*                                                                        */
 /**************************************************************************/
 
@@ -456,7 +459,7 @@ VOID _nx_trace_event_update(TX_TRACE_BUFFER_ENTRY *event, ULONG timestamp, ULONG
 #define AZURE_RTOS_NETXDUO
 #define NETXDUO_MAJOR_VERSION                    6
 #define NETXDUO_MINOR_VERSION                    0
-#define NETXDUO_PATCH_VERSION                    1
+#define NETXDUO_PATCH_VERSION                    2
 
 /* Define the following symbols for backward compatibility */
 #define EL_PRODUCT_NETXDUO
diff --git a/common/src/nx_icmpv6_process_ra.c b/common/src/nx_icmpv6_process_ra.c
index 47528d0e..6d067297 100644
--- a/common/src/nx_icmpv6_process_ra.c
+++ b/common/src/nx_icmpv6_process_ra.c
@@ -37,7 +37,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_icmpv6_process_ra                               PORTABLE C      */
-/*                                                           6.0          */
+/*                                                           6.0.2        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -76,6 +76,9 @@
 /*    DATE              NAME                      DESCRIPTION             */
 /*                                                                        */
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
+/*  08-14-2020     Yuxin Zhou               Modified comment(s), improved */
+/*                                            option length verification, */
+/*                                            resulting in version 6.0.2  */
 /*                                                                        */
 /**************************************************************************/
 VOID _nx_icmpv6_process_ra(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -237,6 +240,19 @@ UINT                          interface_index;
         if (option_ptr -> nx_icmpv6_option_type == ICMPV6_OPTION_TYPE_PREFIX_INFO)
         {
 
+            /* Validate packet length before cast to avoid OOB access. */
+            if (packet_length < (INT)sizeof(NX_ICMPV6_OPTION_PREFIX))
+            {
+#ifndef NX_DISABLE_ICMP_INFO
+
+                /* Increment the ICMP invalid packet error. */
+                ip_ptr -> nx_ip_icmp_invalid_packets++;
+#endif /* NX_DISABLE_ICMP_INFO */
+
+                _nx_packet_release(packet_ptr);
+                return;
+            }
+
             /* Yes, set a local pointer to the option. */
             /*lint -e{929} -e{826} -e{740} suppress cast of pointer to pointer, since it is necessary  */
             prefix_ptr = (NX_ICMPV6_OPTION_PREFIX *)option_ptr;
diff --git a/common/src/nx_ipv6_process_fragment_option.c b/common/src/nx_ipv6_process_fragment_option.c
index a856443d..7a7e7db6 100644
--- a/common/src/nx_ipv6_process_fragment_option.c
+++ b/common/src/nx_ipv6_process_fragment_option.c
@@ -41,7 +41,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_ipv6_process_fragment_option                    PORTABLE C      */
-/*                                                           6.0          */
+/*                                                           6.0.2        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -77,6 +77,9 @@
 /*    DATE              NAME                      DESCRIPTION             */
 /*                                                                        */
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
+/*  08-14-2020     Yuxin Zhou               Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.0.2  */
 /*                                                                        */
 /**************************************************************************/
 UINT _nx_ipv6_process_fragment_option(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -103,6 +106,12 @@ NX_IPV6_HEADER_FRAGMENT_OPTION *fragment_option;
         return(NX_OPTION_HEADER_ERROR);
     }
 
+    /* Check packet length is at least sizeof(NX_IPV6_HEADER_FRAGMENT_OPTION). */
+    if (packet_ptr -> nx_packet_length < sizeof(NX_IPV6_HEADER_FRAGMENT_OPTION))
+    {
+        return(NX_OPTION_HEADER_ERROR);
+    }
+
     /* Set a pointer to the starting of the fragment option. */
     /*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary  */
     fragment_option = (NX_IPV6_HEADER_FRAGMENT_OPTION *)packet_ptr -> nx_packet_prepend_ptr;
diff --git a/common/src/nx_ipv6_process_routing_option.c b/common/src/nx_ipv6_process_routing_option.c
index 3ca2b24b..984cef74 100644
--- a/common/src/nx_ipv6_process_routing_option.c
+++ b/common/src/nx_ipv6_process_routing_option.c
@@ -38,7 +38,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_ipv6_process_routing_option                     PORTABLE C      */
-/*                                                           6.0          */
+/*                                                           6.0.2        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -70,6 +70,9 @@
 /*    DATE              NAME                      DESCRIPTION             */
 /*                                                                        */
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
+/*  08-14-2020     Yuxin Zhou               Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.0.2  */
 /*                                                                        */
 /**************************************************************************/
 UINT _nx_ipv6_process_routing_option(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -84,6 +87,12 @@ UINT                           base_offset;
     /* Add debug information. */
     NX_PACKET_DEBUG(__FILE__, __LINE__, packet_ptr);
 
+    /* Check packet length is at least sizeof(NX_IPV6_HEADER_ROUTING_OPTION). */
+    if (packet_ptr -> nx_packet_length < sizeof(NX_IPV6_HEADER_ROUTING_OPTION))
+    {
+        return(NX_OPTION_HEADER_ERROR);
+    }
+
     /* Set a pointer to the routing header. */
     /*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary  */
     option = (NX_IPV6_HEADER_ROUTING_OPTION *)(packet_ptr -> nx_packet_prepend_ptr);