diff options
| author | Akihiko Odaki <akihiko.odaki@daynix.com> | 2024-11-22 14:03:08 +0900 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2024-11-25 14:00:04 +0800 |
| commit | a8575f7fb2f213e6690b23160b04271d47fdfaa8 (patch) | |
| tree | ac185cec3832abb352de466e34670ca43069a212 | |
| parent | 5930e5ccf38158b090f38554994dab604f01f017 (diff) | |
virtio-net: Fix size check in dhclient workaround
work_around_broken_dhclient() accesses IP and UDP headers to detect
relevant packets and to calculate checksums, but it didn't check if
the packet has size sufficient to accommodate them, causing out-of-bound
access hazards. Fix this by correcting the size requirement.
Fixes: 1d41b0c1ec66 ("Work around dhclient brokenness")
Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| -rw-r--r-- | hw/net/virtio-net.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 75b4a28fb3..a2a8d6b07b 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1697,8 +1697,11 @@ static void virtio_net_hdr_swap(VirtIODevice *vdev, struct virtio_net_hdr *hdr) static void work_around_broken_dhclient(struct virtio_net_hdr *hdr, uint8_t *buf, size_t size) { + size_t csum_size = ETH_HLEN + sizeof(struct ip_header) + + sizeof(struct udp_header); + if ((hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && /* missing csum */ - (size > 27 && size < 1500) && /* normal sized MTU */ + (size >= csum_size && size < 1500) && /* normal sized MTU */ (buf[12] == 0x08 && buf[13] == 0x00) && /* ethertype == IPv4 */ (buf[23] == 17) && /* ip.protocol == UDP */ (buf[34] == 0 && buf[35] == 67)) { /* udp.srcport == bootps */ |