gwj / at91sam9263 · Commits

Commit e8e880a72e63d0587f03aa670be3de683b881ca8

Authored by aurel32
1 parent a810a2de

slirp: fix CVE 2007-5729 

The emulated network cards in QEMU allows local users to execute arbitrary
code by writing Ethernet frames with a size larger than the slirp's default
MTU, which triggers a heap-based buffer overflow in the slirp library.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5920 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 1 changed file with 3 additions and 0 deletions
slirp/slirp.c
  View file @e8e880a
... ... @@ -654,6 +654,9 @@ void slirp_input(const uint8_t *pkt, int pkt_len)
654 654 if (!m)
655 655 return;
656 656 /* Note: we add to align the IP header */
  657 + if (M_FREEROOM(m) < pkt_len + 2) {
  658 + m_inc(m, pkt_len + 2);
  659 + }
657 660 m->m_len = pkt_len + 2;
658 661 memcpy(m->m_data + 2, pkt, pkt_len);
659 662  
... ...