diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2015-07-15 14:30:37 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2015-08-04 12:33:36 -0500 |
| commit | ce4f451bbba8edcd2418cfce434b096602248ab3 (patch) | |
| tree | a59d15ee6a77841de696c55a0cb7f89e3a770398 | |
| parent | 6722c126f385397a0d010e391fea26eaeea14586 (diff) | |
| download | qemu-ce4f451bbba8edcd2418cfce434b096602248ab3.tar.gz | |
rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
Transmit offload features access Ethernet and IP headers the packet. If
the packet is too short we must not attempt to access header fields:
int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
...
eth_payload_data = saved_buffer + ETH_HLEN;
...
ip = (ip_header*)eth_payload_data;
if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit e1c120a9c54872f8a538ff9129d928de4e865cbd)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/net/rtl8139.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c index c044dee346..4e22162604 100644 --- a/hw/net/rtl8139.c +++ b/hw/net/rtl8139.c @@ -2150,6 +2150,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) { DPRINTF("+++ C+ mode offloaded task checksum\n"); + /* Large enough for Ethernet and IP headers? */ + if (saved_size < ETH_HLEN + sizeof(ip_header)) { + goto skip_offload; + } + /* ip packet header */ ip_header *ip = NULL; int hlen = 0; |