Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12:Update
xen
CVE-2018-10839-qemuu-ne2000-integer-overflow-le...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2018-10839-qemuu-ne2000-integer-overflow-leads-to-buffer-overflow-issue.patch of Package xen
References: bsc#1110924 CVE-2018-10839 In ne2000_receive(), we try to assign size_ to size which converts from size_t to integer. This will cause troubles when size_ is greater INT_MAX, this will lead a negative value in size and it can then pass the check of size < MIN_BUF_SIZE which may lead out of bound access of for both buf and buf1. Fixing by converting the type of size to size_t. CC: address@hidden Reported-by: Daniel Shapira <address@hidden> Reviewed-by: Michael S. Tsirkin <address@hidden> Signed-off-by: Jason Wang <address@hidden> --- hw/net/ne2000.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/hw/net/ne2000.c =================================================================== --- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/hw/net/ne2000.c +++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/hw/net/ne2000.c @@ -183,7 +183,7 @@ int ne2000_can_receive(NetClientState *n ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_) { NE2000State *s = qemu_get_nic_opaque(nc); - int size = size_; + size_t size = size_; uint8_t *p; unsigned int total_len, next, avail, len, index, mcast_idx; uint8_t buf1[60]; @@ -191,7 +191,7 @@ ssize_t ne2000_receive(NetClientState *n { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; #if defined(DEBUG_NE2000) - printf("NE2000: received len=%d\n", size); + printf("NE2000: received len=%zu\n", size); #endif if (s->cmd & E8390_STOP || ne2000_buffer_full(s))
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor