[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [qemu-xen stable-4.3] pcnet: fix rx buffer overflow(CVE-2015-7512)
commit fc857bbe30c58b627423c58004d8d6e75df74846 Author: Jason Wang <jasowang@xxxxxxxxxx> AuthorDate: Mon Nov 30 15:00:06 2015 +0800 Commit: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> CommitDate: Fri Feb 5 14:47:09 2016 +0000 pcnet: fix rx buffer overflow(CVE-2015-7512) Backends could provide a packet whose length is greater than buffer size. Check for this and truncate the packet to avoid rx buffer overflow in this case. Cc: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Cc: qemu-stable@xxxxxxxxxx Reviewed-by: Michael S. Tsirkin <mst@xxxxxxxxxx> Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx> --- hw/pcnet.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/pcnet.c b/hw/pcnet.c index c2d8abc..22d20bb 100644 --- a/hw/pcnet.c +++ b/hw/pcnet.c @@ -1083,6 +1083,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) int pktcount = 0; if (!s->looptest) { + if (size > 4092) { +#ifdef PCNET_DEBUG_RMD + fprintf(stderr, "pcnet: truncates rx packet.\n"); +#endif + size = 4092; + } memcpy(src, buf, size); /* no need to compute the CRC */ src[size] = 0; -- generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.3 _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxx http://lists.xensource.com/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |