Tianocore/edk2.git/NetworkPkg, branch dependabot/github_actions/actions/setup-python-7

NetworkPkg/UefiPxeBcDxe: Fix CopyMem destination in PxeBcDhcp6CallBack

2026-07-14T18:10:05+00:00

When caching the DHCPv6 discover packet to Mode->DhcpDiscover in PxeBcDhcp6CallBack, the destination was incorrectly specified as Mode->DhcpDiscover.Dhcpv4 (the DHCPv4 union member). Change it to Mode->DhcpDiscover to correctly reference the union and avoid type confusion when copying a DHCPv6 packet. Signed-off-by: Abuthahir M

NetworkPkg/Ip6Dxe: Add NULL check for InterfaceId before dereference

2026-07-14T18:10:05+00:00

In Ip6ProcessRouterAdvertise, IpSb->InterfaceId is dereferenced in CopyMem to form a stateless address. Add a guard to ensure IpSb->InterfaceId is not NULL before entering the block, preventing a potential NULL pointer dereference. Signed-off-by: Abuthahir M

NetworkPkg/Ip6Dxe: Move neighbor table cleanup before MNP teardown

2026-07-14T18:10:05+00:00

In Ip6CleanService, Ip6FreeNeighborEntry may attempt to send packets via MNP. Defensively move the neighbor table cleanup to occur before MNP teardown so that the MNP child handle and its resources remain valid during neighbor entry cleanup. Signed-off-by: Abuthahir M

NetworkPkg/Dhcp6Dxe: Defensively check for NULL Config in Dhcp6UpdateIaInfo

2026-07-14T18:10:05+00:00

Replace the ASSERT (Instance->Config != NULL) in Dhcp6UpdateIaInfo with an explicit NULL check that returns EFI_DEVICE_ERROR. Also add a complementary guard in Dhcp6GenerateIaCb alongside the existing check for Instance->IaCb.Ia. These are defensive changes to prevent potential NULL pointer dereferences. Signed-off-by: Abuthahir M

NetworkPkg/SnpDxe: Fix MAC address passthrough support

2026-06-30T17:27:16+00:00

During SnpUndi32Initialize(), CurrentAddress is unconditionally overwritten with PermanentAddress before UNDI initialization. This causes MAC address passthrough (MacPassthru) to fail, as the NIC's actual current address, which may differ from its permanent address, is lost. After UNDI initialization completes, call PxeGetStnAddr() to read the NIC's station address via the UNDI interface and update CurrentAddress, PermanentAddress, and BroadcastAddress in the mode structure with the values reported by the hardware. The call is added to both initialization paths: the cable-detect success path and the fallback no-cable-detect path. Signed-off-by: Jared Pan

NetworkPkg/IScsiDxe: bound value length in IScsiBuildKeyValueList

2026-06-30T16:34:46+00:00

IScsiBuildKeyValueList parses the data segment of a received iSCSI login, text or CHAP response into key=value pairs. After locating '=' within the remaining length, it sets KeyValuePair->Value and calls AsciiStrLen(Value) to measure the value before subtracting it from the remaining length. AsciiStrLen has no length cap, and the data segment copied from the received PDU (AllocatePool(Len) + NetbufQueCopy of the data-segment length) is not guaranteed to be NUL-terminated. A malicious or redirecting target can send a data segment whose final value lacks a trailing NUL (e.g. the 3 bytes "X=Y"), so AsciiStrLen reads past the end of the segment allocation, an attacker-controlled out-of-bounds read. The SafeUint32Sub bound check only runs after the over-read. Replace AsciiStrLen(Value) with AsciiStrnLenS(Value, Len), capping the scan to the bytes remaining from Value onward. An unterminated value then returns Len and the existing SafeUint32Sub rejects the segment. The single change covers all three callers (login redirect, operational parameter negotiation and CHAP). Signed-off-by: Syed Mohammed Nayyar

NetworkPkg/UefiPxeBcDxe: Initialize IPV4 token in IPV4 branch

2026-06-25T01:13:27+00:00

EfiPxeBcStart() in PxeBcImpl.c has conditional code branches for IPV4 and IPV6. - IPV4 branch should use EFI_IP4_COMPLETION_TOKEN which is Private->IcmpToken. - IPV6 branch should use EFI_IP6_COMPLETION_TOKEN which is Private->Icmp6Token. Right now, the IPv4 branch incorrectly initializes Private->Icmp6Token to EFI_NOT_READY. That is changed to Private->IcmpToken. Signed-off-by: Michael Kubacki

NetworkPkg: Ip4Dxe: Fix uninitialized variable warning

2026-06-24T14:49:50+00:00

In Ip4FormExtractConfig(), the Status variable was assigned only within a conditional block but used outside of it, which could lead to an uninitialized variable warning. Fix this by moving the relevant code outside of the conditional block so that Status is always properly initialized before use. Signed-off-by: Tuan Phan

NetworkPkg: HttpBootDxe: Fix uninitialized variable warnings

2026-06-24T14:49:50+00:00

In HttpBootGetBootFileCaller(), under the LoadBootFile case, the Status variable is only assigned within a for loop. If the loop is not executed, this results in an uninitialized variable warning when Status is later referenced. Resolve this issue by return Status directly inside the loop. Signed-off-by: Tuan Phan

NetworkPkg/Dhcp6Dxe: bound IA inner option length to buffer

2026-06-18T21:59:02+00:00

Dhcp6SeekInnerOptionSafe() reads the IA_NA/IA_TA option-len field from a received datagram and only validates it against the fixed minimums, never against OptionLen (the bytes actually remaining in the packet). A reply can declare an option-len up to 0xFFFF while the real buffer is only the 16-byte (IA_NA) or 8-byte (IA_TA) minimum, so the returned inner length is far larger than the buffer. That length is then passed as SeekLen to Dhcp6SeekOption(), which walks ReadUnaligned16() cursors up to Buf + SeekLen and reads past the end of the packet allocation, an attacker-controlled out-of-bounds read. Bound the declared inner length against OptionLen minus the IA header size in both the IA_NA and IA_TA branches, rejecting over-declared options with EFI_DEVICE_ERROR. Parenthesize DHCP6_MIN_SIZE_OF_IA_NA so the subtraction in that bound binds correctly. Add host tests covering the over-declared, off-by-one, and exact-boundary cases for both IA_NA and IA_TA. Signed-off-by: jmestwa-coder