The patch is fixing crash on ARP broadcast message when driver attempts to access NULL memory address.
Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Daniil Egranov daniil.egranov@arm.com --- Drivers/Net/Lan91xDxe/Lan91xDxe.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/Drivers/Net/Lan91xDxe/Lan91xDxe.c b/Drivers/Net/Lan91xDxe/Lan91xDxe.c index 3f857a5..053f081 100644 --- a/Drivers/Net/Lan91xDxe/Lan91xDxe.c +++ b/Drivers/Net/Lan91xDxe/Lan91xDxe.c @@ -1818,12 +1818,18 @@ SnpTransmit ( PktNum &= ARR_PACKET;
// Check for the nature of the frame - if (DstAddr->Addr[0] == 0xFF) { - LanDriver->Stats.TxBroadcastFrames += 1; - } else if ((DstAddr->Addr[0] & 0x1) == 1) { - LanDriver->Stats.TxMulticastFrames += 1; + // If no destination address, it's ARP broadcast + if(DstAddr != NULL) + { + if (DstAddr->Addr[0] == 0xFF) { + LanDriver->Stats.TxBroadcastFrames += 1; + } else if ((DstAddr->Addr[0] & 0x1) == 1) { + LanDriver->Stats.TxMulticastFrames += 1; + } else { + LanDriver->Stats.TxUnicastFrames += 1; + } } else { - LanDriver->Stats.TxUnicastFrames += 1; + LanDriver->Stats.TxBroadcastFrames += 1; }
// Set the Packet Number and Pointer registers