diff options
| author | Jason Wang <jasowang@redhat.com> | 2015-11-30 15:00:06 +0800 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2015-12-07 21:43:48 +0800 |
| commit | 8b98a2f07175d46c3f7217639bd5e03f2ec56343 (patch) | |
| tree | e2fa47b137dcfff8c0bed02c1b88ed319bd94b44 | |
| parent | 837f21aacf5a714c23ddaadbbc5212f9b661e3f7 (diff) | |
pcnet: fix rx buffer overflow(CVE-2015-7512)
Backends could provide a packet whose length is greater than buffer
size. Check for this and truncate the packet to avoid rx buffer
overflow in this case.
Cc: Prasad J Pandit <pjp@fedoraproject.org>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| -rw-r--r-- | hw/net/pcnet.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c index 309c40bc31..1f4a3dbe49 100644 --- a/hw/net/pcnet.c +++ b/hw/net/pcnet.c @@ -1064,6 +1064,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) int pktcount = 0; if (!s->looptest) { + if (size > 4092) { +#ifdef PCNET_DEBUG_RMD + fprintf(stderr, "pcnet: truncates rx packet.\n"); +#endif + size = 4092; + } memcpy(src, buf, size); /* no need to compute the CRC */ src[size] = 0; |