From ab50ab6ea159821d780be60759874dcf38835d1b Mon Sep 17 00:00:00 2001
From: Jiaxin Wu <jiaxin.wu@intel.com>
Date: Tue, 3 Jan 2017 11:27:38 +0800
Subject: NetworkPkg/Ip6Dxe: Fix the potential NULL pointer free

Ip6ConfigSetDnsServer may cause ASSERT if the invalid DNS
server address received. The issue is triggered by the NULL
pointer(Tmp) free.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
---
 NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c b/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
index 9b6a62e9ec..4e881fd6df 100644
--- a/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
+++ b/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
@@ -1,7 +1,7 @@
 /** @file
   The implementation of EFI IPv6 Configuration Protocol.
 
-  Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
 
   This program and the accompanying materials
   are licensed and made available under the terms and conditions of the BSD License
@@ -1366,13 +1366,17 @@ Ip6ConfigSetDnsServer (
       //
       // The dns server address must be unicast.
       //
-      FreePool (Tmp);
+      if (Tmp != NULL) {
+        FreePool (Tmp);
+      }
       return EFI_INVALID_PARAMETER;
     }
 
     for (Index1 = NewIndex + 1; Index1 < NewDnsCount; Index1++) {
       if (EFI_IP6_EQUAL (NewDns + NewIndex, NewDns + Index1)) {
-        FreePool (Tmp);
+        if (Tmp != NULL) {
+          FreePool (Tmp);
+        }
         return EFI_INVALID_PARAMETER;
       }
     }
-- 
cgit v1.2.3