Re: [Qemu-stable] [PATCH] net: vmxnet: check IP header length

[Michael Roth]

Quoting P J P (2016-08-09 06:19:47)
> From: Li Qiang <address@hidden>
> 
> Vmxnet3 device emulator when parsing packet headers does not check
> for IP header length. It could lead to a OOB access when reading
> further packet data. Add check to avoid it.
> 
> Reported-by: Li Qiang <address@hidden>
> Signed-off-by: Prasad J Pandit <address@hidden>

Thanks, applied directly for 2.6.2.

> ---
>  hw/net/vmxnet_tx_pkt.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c
> index 91e1e08..32563d4 100644
> --- a/hw/net/vmxnet_tx_pkt.c
> +++ b/hw/net/vmxnet_tx_pkt.c
> @@ -178,6 +178,11 @@ static bool vmxnet_tx_pkt_parse_headers(struct 
> VmxnetTxPkt *pkt)
>          }
> 
>          l3_hdr->iov_len = IP_HDR_GET_LEN(l3_hdr->iov_base);
> +        if(l3_hdr->iov_len < sizeof(struct ip_header))
> +        {
> +            l3_hdr->iov_len = 0;
> +            return false;
> +        }
>          pkt->l4proto = ((struct ip_header *) l3_hdr->iov_base)->ip_p;
> 
>          /* copy optional IPv4 header data */
> -- 
> 2.5.5
> 
>