Added harness to cover CVE-2023-45229: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message

HBFA/UefiHostFuzzTestCasePkg/Seed/Dhcp6SeekStsOption/random_45bytes.bin

@@ -0,0 +1 @@
+�
�J������j�o[���ߵ�KmU@(j�k�ˍ����

HBFA/UefiHostFuzzTestCasePkg/TestCase/NetworkPkg/TestDhcp6SeekStsOption/TestDhcp6SeekStsOption.c

@@ -0,0 +1,125 @@
+/** @file
+
+
+**/
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+#include <Uefi.h>
+
+#include <Library/BaseLib.h>
+#include <Library/DebugLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/Dhcp6SeekStsOptionStubLib.h>
+
+#define DHCPV6_PACKED_OPTION_DATA 24
+
+
+VOID
+FixBuffer (
+  UINT8                   *TestBuffer
+  )
+{
+}
+
+UINTN
+EFIAPI
+GetMaxBufferSize (
+  VOID
+  )
+{
+  return (
+    sizeof(EFI_DHCP6_IA_DESCRIPTOR) // IaDescriptor
+  + sizeof(EFI_DHCP6_HEADER) // DHCP6 Header
+  + DHCPV6_PACKED_OPTION_DATA // Max Length of DHCPv6 packed option data
+  );
+}
+
+VOID
+EFIAPI
+RunTestHarness(
+  IN VOID  *TestBuffer,
+  IN UINTN TestBufferSize
+  )
+{
+  DHCP6_INSTANCE    *Instance;
+  EFI_DHCP6_PACKET  *Packet;
+  UINT8             **Option;
+
+  Instance = (DHCP6_INSTANCE *)AllocateZeroPool (sizeof (DHCP6_INSTANCE));
+  if (!Instance) {
+    printf("Allocation failed!\n");
+    return;
+  }
+  Packet = (EFI_DHCP6_PACKET *)AllocateZeroPool (sizeof (EFI_DHCP6_PACKET) + DHCPV6_PACKED_OPTION_DATA);
+  if (!Packet) {
+    printf("Allocation failed!\n");
+    FreePool(Instance);
+    return;
+  }
+  Option = (UINT8 **)AllocateZeroPool (sizeof (UINT8 *));
+  if (!Option) {
+    printf("Allocation failed!\n");
+    FreePool(Packet);
+    FreePool(Instance);
+    return;
+  }
+  Instance->Config = (EFI_DHCP6_CONFIG_DATA *)AllocateZeroPool (sizeof (EFI_DHCP6_CONFIG_DATA));
+  if (!Instance->Config) {
+    printf("Allocation failed!\n");
+    FreePool(Option);
+    FreePool(Packet);
+    FreePool(Instance);
+    return;
+  }
+
+  // Packet and IaDescriptor are fed from TestBuffer
+  // IaDescriptor is 8 bytes (sizeof(EFI_DHCP6_IA_DESCRIPTOR))
+  // Dhcp6 Header + Options is sizeof(EFI_DHCP6_HEADER) + DHCPV6_PACKED_OPTION_DATA bytes
+  // Total minimum TestBufferSize = 8 + sizeof(EFI_DHCP6_HEADER) + 24 bytes
+
+  if (TestBufferSize < (sizeof(EFI_DHCP6_IA_DESCRIPTOR) + sizeof(EFI_DHCP6_HEADER) + DHCPV6_PACKED_OPTION_DATA)) {
+    printf("TestBufferSize is too small!\n");
+    FreePool(Instance->Config);
+    FreePool(Option);
+    FreePool(Packet);
+    FreePool(Instance);
+    return;
+  }
+
+  // 1. Initialize Instance->Config->IaDescriptor, Packet options buffer from TestBuffer
+  EFI_STATUS Status = InitializeDhcp6SeekStsOption(&Instance->Config->IaDescriptor, (EFI_DHCP6_HEADER *)&Packet->Dhcp6, DHCPV6_PACKED_OPTION_DATA, TestBuffer, TestBufferSize);
+
+  // Initialize packed option data buffer length
+
+  // Size of the EFI_DHCP6_PACKET buffer.
+  Packet->Size = sizeof (EFI_DHCP6_PACKET) + DHCPV6_PACKED_OPTION_DATA;
+
+  // Length of the EFI_DHCP6_PACKET from the first byte of the Header field 
+  // to the last byte of the Option[] field.
+  Packet->Length = sizeof(EFI_DHCP6_HEADER) + DHCPV6_PACKED_OPTION_DATA;
+
+
+  if (EFI_ERROR (Status)) {
+    FreePool(Instance->Config);
+    FreePool(Option);
+    FreePool(Packet);
+    FreePool(Instance);
+    return;
+  }
+
+  // 2. Call the function under test
+  Dhcp6SeekStsOption( Instance, Packet, Option);
+
+  // 3. Clean up allocated resources
+  FreePool(Instance->Config);
+  FreePool(Option);
+  FreePool(Packet);
+  FreePool(Instance);
+
+  return;
+}

HBFA/UefiHostFuzzTestCasePkg/TestCase/NetworkPkg/TestDhcp6SeekStsOption/TestDhcp6SeekStsOption.inf

@@ -0,0 +1,54 @@
+## @file
+#  Client-side DHCPv6 services.
+#
+#  This driver produces EFI DHCPv6 Protocol which is used to get IPv6 addresses
+#  and other configuration parameters from DHCPv6 servers.
+#
+#  (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
+#  Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+#
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = TestDhcp6SeekStsOption
+  FILE_GUID                      = 95E3669D-34BE-4775-A651-7EA41B69D89E
+  MODULE_TYPE                    = USER_DEFINED
+  VERSION_STRING                 = 1.0
+  ENTRY_POINT                    = Dhcp6DriverEntryPoint
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64 EBC
+#
+#  DRIVER_BINDING                =  gDhcp6DriverBinding
+#  COMPONENT_NAME                =  gDhcp6ComponentName
+#  COMPONENT_NAME2               =  gDhcp6ComponentName2
+#
+
+[Sources]
+  TestDhcp6SeekStsOption.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  NetworkPkg/NetworkPkg.dec
+  UefiHostTestPkg/UefiHostTestPkg.dec
+  UefiHostFuzzTestCasePkg/UefiHostFuzzTestCasePkg.dec
+
+[LibraryClasses]
+  UefiLib
+  BaseLib
+  BaseMemoryLib
+  MemoryAllocationLib
+  UefiDriverEntryPoint
+  UefiBootServicesTableLib
+  UefiRuntimeServicesTableLib
+  DebugLib
+  NetLib
+  UdpIoLib
+  Dhcp6SeekStsOptionStubLib
+  ToolChainHarnessLib