File xsa140-qemut-5.patch of Package xen.3680

Overview Repositories Revisions Requests Users Attributes Meta

File xsa140-qemut-5.patch of Package xen.3680

References: bsc#939712 XSA-140

From 6c79ea275d72bc1fd88bdcf1e7d231b2c9c865de Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Wed, 15 Jul 2015 18:17:02 +0100
Subject: [PATCH 5/7] rtl8139: check IP Total Length field

The IP Total Length field includes the IP header and data.  Make sure it
is valid and does not exceed the Ethernet payload size.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/rtl8139.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
@@ -2144,7 +2144,12 @@ static int rtl8139_cplus_transmit_one(RT
             }
 
             ip_protocol = ip->ip_p;
-            ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
+
+            ip_data_len = be16_to_cpu(ip->ip_len);
+            if (ip_data_len < hlen || ip_data_len > eth_payload_len) {
+                goto skip_offload;
+            }
+            ip_data_len -= hlen;
 
             if (txdw0 & CP_TX_IPCS)
             {

Places

File xsa140-qemut-5.patch of Package xen.3680

Places