aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJason Wang <jasowang@redhat.com>2015-11-30 15:00:06 +0800
committerJason Wang <jasowang@redhat.com>2015-12-07 21:43:48 +0800
commit8b98a2f07175d46c3f7217639bd5e03f2ec56343 (patch)
treee2fa47b137dcfff8c0bed02c1b88ed319bd94b44
parent837f21aacf5a714c23ddaadbbc5212f9b661e3f7 (diff)
downloadqemu-8b98a2f07175d46c3f7217639bd5e03f2ec56343.tar.gz
qemu-8b98a2f07175d46c3f7217639bd5e03f2ec56343.tar.xz
qemu-8b98a2f07175d46c3f7217639bd5e03f2ec56343.zip
pcnet: fix rx buffer overflow(CVE-2015-7512)
Backends could provide a packet whose length is greater than buffer size. Check for this and truncate the packet to avoid rx buffer overflow in this case. Cc: Prasad J Pandit <pjp@fedoraproject.org> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
-rw-r--r--hw/net/pcnet.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index 309c40bc3..1f4a3dbe4 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -1064,6 +1064,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
int pktcount = 0;
if (!s->looptest) {
+ if (size > 4092) {
+#ifdef PCNET_DEBUG_RMD
+ fprintf(stderr, "pcnet: truncates rx packet.\n");
+#endif
+ size = 4092;
+ }
memcpy(src, buf, size);
/* no need to compute the CRC */
src[size] = 0;