[Xen-changelog] [qemu-xen-traditional stable-4.3] net: pcnet: add check to validate receive data size(CVE-2015-7504)

[patchbot@xxxxxxx]

commit d886904dd6875648b33d58bb7d2fe75b45e4ea12
Author:     Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
AuthorDate: Wed Dec 9 11:47:35 2015 +0000
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Wed Dec 9 11:49:22 2015 +0000

    net: pcnet: add check to validate receive data size(CVE-2015-7504)
    
    In loopback mode, pcnet_receive routine appends CRC code to the
    receive buffer. If the data size given is same as the buffer size,
    the appended CRC code overwrites 4 bytes after s->buffer. Added a
    check to avoid that.
    
    This is XSA-162.
    
    Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx>
    Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx>
    (cherry picked from commit 91c15bfaec1764ce2896a393eabee1183afe1130)
    (cherry picked from commit aaaf657c8f6106da6d7e97ad0d08ed291cc895c7)
    (cherry picked from commit 3159615c393e0b981e00ecd0e06fcfd44235f2d4)
    (cherry picked from commit 6425f5d8c25a4d6486435278bcccefd8810becf0)
---
 hw/pcnet.c |   13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/hw/pcnet.c b/hw/pcnet.c
index 4e81267..6a101f2 100644
--- a/hw/pcnet.c
+++ b/hw/pcnet.c
@@ -1153,7 +1153,7 @@ static void pcnet_receive(void *opaque, const uint8_t 
*buf, int size)
                 uint32_t fcs = ~0;
                 uint8_t *p = src;
 
-                while (p != &src[size-4])
+                while (p != &src[size])
                     CRC(fcs, *p++);
                 crc_err = (*(uint32_t *)p != htonl(fcs));
             }
@@ -1284,12 +1284,13 @@ static void pcnet_transmit(PCNetState *s)
         bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
 
         /* if multi-tmd packet outsizes s->buffer then skip it silently.
-           Note: this is not what real hw does */
-        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
-           s->xmit_pos = -1;
-           goto txdone;
+         * Note: this is not what real hw does.
+         * Last four bytes of s->buffer are used to store CRC FCS code.
+         */
+        if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) {
+            s->xmit_pos = -1;
+            goto txdone;
         }
-
         s->phys_mem_read(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
                          s->buffer + s->xmit_pos, bcnt, CSR_BSWP(s));
         s->xmit_pos += bcnt;
--
generated by git-patchbot for /home/xen/git/qemu-xen-traditional.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog