eaced9c278
security fix for CVE-2019-14378 OBS-URL: https://build.opensuse.org/request/show/721580 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=485
37 lines
1.2 KiB
Diff
37 lines
1.2 KiB
Diff
From 126c04acbabd7ad32c2b018fe10dfac2a3bc1210 Mon Sep 17 00:00:00 2001
|
|
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Date: Sun, 28 Jul 2019 19:11:24 +0200
|
|
Subject: [PATCH] Fix heap overflow in ip_reass on big packet input
|
|
|
|
When the first fragment does not fit in the preallocated buffer, q will
|
|
already be pointing to the ext buffer, so we mustn't try to update it.
|
|
|
|
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
(cherry picked from commit 126c04acbabd7ad32c2b018fe10dfac2a3bc1210)
|
|
[LY: CVE-2019-14378 BSC#1143794]
|
|
Signed-off-by: Liang Yan <lyan@suse.com>
|
|
---
|
|
src/ip_input.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
--- a/src/ip_input.c
|
|
+++ b/src/ip_input.c
|
|
@@ -331,6 +331,8 @@ insert:
|
|
q = fp->frag_link.next;
|
|
m = dtom(slirp, q);
|
|
|
|
+ int was_ext = m->m_flags & M_EXT;
|
|
+
|
|
q = (struct ipasfrag *) q->ipf_next;
|
|
while (q != (struct ipasfrag*)&fp->frag_link) {
|
|
struct mbuf *t = dtom(slirp, q);
|
|
@@ -353,7 +355,7 @@ insert:
|
|
* the old buffer (in the mbuf), so we must point ip
|
|
* into the new buffer.
|
|
*/
|
|
- if (m->m_flags & M_EXT) {
|
|
+ if (!was_ext && m->m_flags & M_EXT) {
|
|
int delta = (char *)q - m->m_dat;
|
|
q = (struct ipasfrag *)(m->m_ext + delta);
|
|
}
|