diff --git a/qemu-testsuite.changes b/qemu-testsuite.changes
index 3f71701..0c76da8 100644
--- a/qemu-testsuite.changes
+++ b/qemu-testsuite.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Wed Aug  7 02:40:53 UTC 2019 - Liang Yan <lyan@suse.com>
+
+- Security fix for heap overflow in ip_reass on big packet input
+  (CVE-2019-14378, bsc#1143794) 
+  slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
+
 -------------------------------------------------------------------
 Tue Aug  6 14:45:35 UTC 2019 - Bruce Rogers <brogers@suse.com>
 
diff --git a/qemu-testsuite.spec b/qemu-testsuite.spec
index 07cc109..99f6190 100644
--- a/qemu-testsuite.spec
+++ b/qemu-testsuite.spec
@@ -224,6 +224,9 @@ Patch1600:      keycodemapdb-make-keycode-gen-output-reproducible.patch
 
 # openBIOS - path: roms/openbios (patch range 1700-1799) (Currently no patches)
 
+# slirp - patch: slirp/ (patch range 1800-1899)
+Patch1800:      slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
+
 # If for any reason we have any QEMU patches which are conditionally applied,
 # "manually" include them here:
 
@@ -1056,6 +1059,10 @@ popd
 pushd roms/openbios
 popd
 
+pushd slirp/
+%patch1800 -p1
+popd
+
 %if "%{name}" != "qemu-testsuite"
 # delete the firmware files that we intend to build
 for i in %built_firmware
diff --git a/qemu.changes b/qemu.changes
index 3f71701..0c76da8 100644
--- a/qemu.changes
+++ b/qemu.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Wed Aug  7 02:40:53 UTC 2019 - Liang Yan <lyan@suse.com>
+
+- Security fix for heap overflow in ip_reass on big packet input
+  (CVE-2019-14378, bsc#1143794) 
+  slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
+
 -------------------------------------------------------------------
 Tue Aug  6 14:45:35 UTC 2019 - Bruce Rogers <brogers@suse.com>
 
diff --git a/qemu.spec b/qemu.spec
index 084c115..7da4639 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -224,6 +224,9 @@ Patch1600:      keycodemapdb-make-keycode-gen-output-reproducible.patch
 
 # openBIOS - path: roms/openbios (patch range 1700-1799) (Currently no patches)
 
+# slirp - patch: slirp/ (patch range 1800-1899)
+Patch1800:      slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
+
 # If for any reason we have any QEMU patches which are conditionally applied,
 # "manually" include them here:
 
@@ -1056,6 +1059,10 @@ popd
 pushd roms/openbios
 popd
 
+pushd slirp/
+%patch1800 -p1
+popd
+
 %if "%{name}" != "qemu-testsuite"
 # delete the firmware files that we intend to build
 for i in %built_firmware
diff --git a/qemu.spec.in b/qemu.spec.in
index c84c93f..f5ada61 100644
--- a/qemu.spec.in
+++ b/qemu.spec.in
@@ -171,6 +171,9 @@ Patch1600:      keycodemapdb-make-keycode-gen-output-reproducible.patch
 
 # openBIOS - path: roms/openbios (patch range 1700-1799) (Currently no patches)
 
+# slirp - patch: slirp/ (patch range 1800-1899)
+Patch1800:      slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
+
 # If for any reason we have any QEMU patches which are conditionally applied,
 # "manually" include them here:
 
@@ -953,6 +956,10 @@ popd
 pushd roms/openbios
 popd
 
+pushd slirp/
+%patch1800 -p1
+popd
+
 %if "%{name}" != "qemu-testsuite"
 # delete the firmware files that we intend to build
 for i in %built_firmware
diff --git a/slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input.patch b/slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
new file mode 100644
index 0000000..b16be8c
--- /dev/null
+++ b/slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
@@ -0,0 +1,36 @@
+From 126c04acbabd7ad32c2b018fe10dfac2a3bc1210 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Sun, 28 Jul 2019 19:11:24 +0200
+Subject: [PATCH] Fix heap overflow in ip_reass on big packet input
+
+When the first fragment does not fit in the preallocated buffer, q will
+already be pointing to the ext buffer, so we mustn't try to update it.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+(cherry picked from commit 126c04acbabd7ad32c2b018fe10dfac2a3bc1210)
+[LY: CVE-2019-14378 BSC#1143794]
+Signed-off-by: Liang Yan <lyan@suse.com>
+---
+ src/ip_input.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/src/ip_input.c
++++ b/src/ip_input.c
+@@ -331,6 +331,8 @@ insert:
+     q = fp->frag_link.next;
+ 	m = dtom(slirp, q);
+ 
++    int was_ext = m->m_flags & M_EXT;
++
+ 	q = (struct ipasfrag *) q->ipf_next;
+ 	while (q != (struct ipasfrag*)&fp->frag_link) {
+ 	  struct mbuf *t = dtom(slirp, q);
+@@ -353,7 +355,7 @@ insert:
+ 	 * the old buffer (in the mbuf), so we must point ip
+ 	 * into the new buffer.
+ 	 */
+-	if (m->m_flags & M_EXT) {
++	if (!was_ext && m->m_flags & M_EXT) {
+ 	  int delta = (char *)q - m->m_dat;
+ 	  q = (struct ipasfrag *)(m->m_ext + delta);
+ 	}