diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2015-07-15 14:30:37 +0100 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2015-08-03 13:08:00 +0100 |
| commit | e1c120a9c54872f8a538ff9129d928de4e865cbd (patch) | |
| tree | f0c6ffaac0136110e74cc72a6d9299c37f04d859 /hw | |
| parent | d6812d60e7932de3cd0f602c0ee63dd3d09f1847 (diff) | |
rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
Transmit offload features access Ethernet and IP headers the packet. If
the packet is too short we must not attempt to access header fields:
int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
...
eth_payload_data = saved_buffer + ETH_HLEN;
...
ip = (ip_header*)eth_payload_data;
if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/net/rtl8139.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c index db36b65249..1c620763d8 100644 --- a/hw/net/rtl8139.c +++ b/hw/net/rtl8139.c @@ -2150,6 +2150,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) { DPRINTF("+++ C+ mode offloaded task checksum\n"); + /* Large enough for Ethernet and IP headers? */ + if (saved_size < ETH_HLEN + sizeof(ip_header)) { + goto skip_offload; + } + /* ip packet header */ ip_header *ip = NULL; int hlen = 0; |