dfaggioli/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

slirp: udp: fix NULL pointer dereference because of uninitialized socket

Browse Source 
When guest sends udp packet with source port and source addr 0,
uninitialized socket is picked up when looking for matching and already
created udp sockets, and later passed to sosendto() where NULL pointer
dereference is hit during so->slirp->vnetwork_mask.s_addr access.

Fix this by checking that the socket is not just a socket stub.

This is CVE-2014-3640.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com>
Reported-by: Stephane Duverger <stephane.duverger@eads.net>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 01f7cecf00)
[AF: BNC#897654]
Signed-off-by: Andreas Färber <afaerber@suse.de>
This commit is contained in:
Petr Matousek
2014-09-18 08:35:37 +02:00
committed by Bruce Rogers
parent e87058cc54
commit 6d9a092479
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
slirp/udp.c
View File

@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen)
* Locate pcb for datagram. * Locate pcb for datagram.
*/ */
so = slirp->udp_last_so; so = slirp->udp_last_so;
if (so->so_lport != uh->uh_sport || if (so == &slirp->udb || so->so_lport != uh->uh_sport ||
so->so_laddr.s_addr != ip->ip_src.s_addr) { so->so_laddr.s_addr != ip->ip_src.s_addr) {
struct socket *tmp; struct socket *tmp;