[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH stable-0.15 05/36] e1000: bounds packet size against
From: |
Andreas Färber |
Subject: |
[Qemu-devel] [PATCH stable-0.15 05/36] e1000: bounds packet size against buffer size |
Date: |
Wed, 28 Mar 2012 14:52:08 +0200 |
From: Anthony Liguori <address@hidden>
Otherwise we can write beyond the buffer and corrupt memory. This is tracked
as CVE-2012-0029.
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 65f82df0d7a71ce1b10cd4c5ab08888d176ac840)
Signed-off-by: Bruce Rogers <address@hidden>
[AF: stable-0.15 does not have pci_dma_read(). Fixes BNC#740165.]
Signed-off-by: Andreas Färber <address@hidden>
---
hw/e1000.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/hw/e1000.c b/hw/e1000.c
index 7971457..c91790b 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -472,6 +472,8 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
bytes = split_size;
if (tp->size + bytes > msh)
bytes = msh - tp->size;
+
+ bytes = MIN(sizeof(tp->data) - tp->size, bytes);
cpu_physical_memory_read(addr, tp->data + tp->size, bytes);
if ((sz = tp->size + bytes) >= hdr && tp->size < hdr)
memmove(tp->header, tp->data, hdr);
@@ -487,6 +489,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
// context descriptor TSE is not set, while data descriptor TSE is set
DBGOUT(TXERR, "TCP segmentaion Error\n");
} else {
+ split_size = MIN(sizeof(tp->data) - tp->size, split_size);
cpu_physical_memory_read(addr, tp->data + tp->size, split_size);
tp->size += split_size;
}
--
1.7.7
- [Qemu-devel] [PATCH stable-0.15 35/36] Add missing trace call to oslib-posix.c:qemu_vmalloc(), (continued)
- [Qemu-devel] [PATCH stable-0.15 35/36] Add missing trace call to oslib-posix.c:qemu_vmalloc(), Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 03/36] e1000: use MII status register for link up/down, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 02/36] qdev: Reset hot-plugged devices, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 04/36] e1000: Don't set the Capabilities List bit, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 16/36] vvfat: Fix potential buffer overflow, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 25/36] block: Fix vpc initialization of the Dynamic Disk Header, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 15/36] ac97: don't override the pci subsystem id, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 08/36] vmdk: vmdk_read_cid returns garbage if p_name is NULL, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 14/36] hw/lan9118.c: Add missing 'break' to fix buffer overrun, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 18/36] block/curl: Implement a flush function on the fd handlers, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 05/36] e1000: bounds packet size against buffer size,
Andreas Färber <=
- [Qemu-devel] [PATCH stable-0.15 20/36] hda: do not mix output and input stream states, RHBZ #740493, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 23/36] block: set bs->read_only before .bdrv_open(), Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 12/36] migration: flush migration data to disk., Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 27/36] block: reinitialize across bdrv_close()/bdrv_open(), Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 21/36] Teach block/vdi about "discarded" (no longer allocated) blocks, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 17/36] vns/tls: don't use depricated gnutls functions, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 06/36] compatfd.c: Don't pass NULL pointer to SYS_signalfd, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 29/36] vmdk: Fix possible segfaults, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 22/36] vmdk: Improve error handling, Andreas Färber, 2012/03/28
- [Qemu-devel] [PATCH stable-0.15 28/36] qxl: stride fixup, Andreas Färber, 2012/03/28