[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [qemu-xen-traditional stable-4.5] rtl8139: check TCP Data Offset field
commit f1cfdc3daeaf47c67f15bfb67d9327e156060f1b Author: Stefan Hajnoczi <stefanha@xxxxxxxxxx> AuthorDate: Wed Jul 15 18:17:04 2015 +0100 Commit: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx> CommitDate: Tue May 10 19:15:54 2016 +0100 rtl8139: check TCP Data Offset field The TCP Data Offset field contains the length of the header. Make sure it is valid and does not exceed the IP data length. Signed-off-by: Stefan Hajnoczi <stefanha@xxxxxxxxxx> [Backport to qemu-xen-tradition] Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> --- hw/rtl8139.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/rtl8139.c b/hw/rtl8139.c index 0bb4583..2ca5a9b 100644 --- a/hw/rtl8139.c +++ b/hw/rtl8139.c @@ -2193,6 +2193,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr); + /* Invalid TCP data offset? */ + if (tcp_hlen < sizeof(tcp_header) || tcp_hlen > ip_data_len) { + goto skip_offload; + } + /* ETH_MTU = ip header len + tcp header len + payload */ int tcp_data_len = ip_data_len - tcp_hlen; int tcp_chunk_size = ETH_MTU - hlen - tcp_hlen; -- generated by git-patchbot for /home/xen/git/qemu-xen-traditional.git#stable-4.5 _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxx http://lists.xensource.com/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |