Re: [Qemu-stable] [PATCH] net: vmxnet: check IP header length

[Dmitry Fleytman]

Hi,

Thanks for the patch, but as far as I see this was already fixed upstream:

https://github.com/qemu/qemu/blob/ab861f3915e8667927cf18ad97f71cae7ccf8818/hw/net/net_tx_pkt.c#L204

~Dmitry

On 9 Aug 2016, at 14:19 PM, P J P <address@hidden> wrote:

From: Li Qiang <address@hidden>

Vmxnet3 device emulator when parsing packet headers does not check
for IP header length. It could lead to a OOB access when reading
further packet data. Add check to avoid it.

Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
hw/net/vmxnet_tx_pkt.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c
index 91e1e08..32563d4 100644
--- a/hw/net/vmxnet_tx_pkt.c
+++ b/hw/net/vmxnet_tx_pkt.c
@@ -178,6 +178,11 @@ static bool vmxnet_tx_pkt_parse_headers(struct VmxnetTxPkt *pkt)
        }

        l3_hdr->iov_len = IP_HDR_GET_LEN(l3_hdr->iov_base);
+        if(l3_hdr->iov_len < sizeof(struct ip_header))
+        {
+            l3_hdr->iov_len = 0;
+            return false;
+        }
        pkt->l4proto = ((struct ip_header *) l3_hdr->iov_base)->ip_p;

        /* copy optional IPv4 header data */
--
2.5.5