[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH-for-3.1.1 1/1] Fix heap overflow in ip_reass on
From: |
Marc-André Lureau |
Subject: |
Re: [Qemu-devel] [PATCH-for-3.1.1 1/1] Fix heap overflow in ip_reass on big packet input |
Date: |
Sat, 3 Aug 2019 02:18:53 +0400 |
On Fri, Aug 2, 2019 at 10:09 PM Philippe Mathieu-Daudé
<address@hidden> wrote:
>
> From: Samuel Thibault <address@hidden>
>
> When the first fragment does not fit in the preallocated buffer, q will
> already be pointing to the ext buffer, so we mustn't try to update it.
>
> Signed-off-by: Samuel Thibault <address@hidden>
> (cherry picked from libslirp commit 126c04acbabd7ad32c2b018fe10dfac2a3bc1210)
> Fixes: CVE-2019-14378
> Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Marc-André Lureau <address@hidden>
thanks
> ---
> slirp/ip_input.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/slirp/ip_input.c b/slirp/ip_input.c
> index 348e1dca5a..07d8808671 100644
> --- a/slirp/ip_input.c
> +++ b/slirp/ip_input.c
> @@ -334,6 +334,8 @@ insert:
> q = fp->frag_link.next;
> m = dtom(slirp, q);
>
> + int was_ext = m->m_flags & M_EXT;
> +
> q = (struct ipasfrag *) q->ipf_next;
> while (q != (struct ipasfrag*)&fp->frag_link) {
> struct mbuf *t = dtom(slirp, q);
> @@ -356,7 +358,7 @@ insert:
> * the old buffer (in the mbuf), so we must point ip
> * into the new buffer.
> */
> - if (m->m_flags & M_EXT) {
> + if (!was_ext && m->m_flags & M_EXT) {
> int delta = (char *)q - m->m_dat;
> q = (struct ipasfrag *)(m->m_ext + delta);
> }
> --
> 2.20.1
>
>
--
Marc-André Lureau