[Xen-changelog] [qemu-upstream-unstable] net: add checks to validate ring buffer pointers(CVE-2015-5279)

[patchbot@xxxxxxx]

commit 25d01b6912a6ed09fc0479791f2920e196dc1ab7
Author:     P J P <pjp@xxxxxxxxxxxxxxxxx>
AuthorDate: Tue Sep 15 16:40:49 2015 +0530
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
CommitDate: Tue Sep 15 13:43:24 2015 +0000

    net: add checks to validate ring buffer pointers(CVE-2015-5279)
    
    Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
    bytes to process network packets. While receiving packets
    via ne2000_receive() routine, a local 'index' variable
    could exceed the ring buffer size, which could lead to a
    memory buffer overflow. Added other checks at initialisation.
    
    upstream-commit-id: 9bbdbc66e5765068dce76e9269dce4547afd8ad4
    
    Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx>
    Signed-off-by: P J P <pjp@xxxxxxxxxxxxxxxxx>
    Signed-off-by: Stefan Hajnoczi <stefanha@xxxxxxxxxx>
    Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
---
 hw/net/ne2000.c |   19 +++++++++++++++----
 1 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index 3ab2d03..109ef4e 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -230,6 +230,9 @@ ssize_t ne2000_receive(NetClientState *nc, const uint8_t 
*buf, size_t size_)
     }
 
     index = s->curpag << 8;
+    if (index >= NE2000_PMEM_END) {
+        index = s->start;
+    }
     /* 4 bytes for header */
     total_len = size + 4;
     /* address for next packet (4 bytes for CRC) */
@@ -315,13 +318,19 @@ static void ne2000_ioport_write(void *opaque, uint32_t 
addr, uint32_t val)
         offset = addr | (page << 4);
         switch(offset) {
         case EN0_STARTPG:
-            s->start = val << 8;
+            if (val << 8 <= NE2000_PMEM_END) {
+                s->start = val << 8;
+            }
             break;
         case EN0_STOPPG:
-            s->stop = val << 8;
+            if (val << 8 <= NE2000_PMEM_END) {
+                s->stop = val << 8;
+            }
             break;
         case EN0_BOUNDARY:
-            s->boundary = val;
+            if (val << 8 < NE2000_PMEM_END) {
+                s->boundary = val;
+            }
             break;
         case EN0_IMR:
             s->imr = val;
@@ -362,7 +371,9 @@ static void ne2000_ioport_write(void *opaque, uint32_t 
addr, uint32_t val)
             s->phys[offset - EN1_PHYS] = val;
             break;
         case EN1_CURPAG:
-            s->curpag = val;
+            if (val << 8 < NE2000_PMEM_END) {
+                s->curpag = val;
+            }
             break;
         case EN1_MULT ... EN1_MULT + 7:
             s->mult[offset - EN1_MULT] = val;
--
generated by git-patchbot for /home/xen/git/qemu-upstream-unstable.git

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog