File 0047-pcnet-force-the-buffer-access-to-be.patch of Package qemu

Overview Repositories Revisions Requests Users Attributes Meta

File 0047-pcnet-force-the-buffer-access-to-be.patch of Package qemu (Revision ca3cc1d77de3a27238af7ca8b45956a9)

Currently displaying revision ca3cc1d77de3a27238af7ca8b45956a9 , Show latest

From 6bc5aaaff43c767625429c3e863674c749fe0082 Mon Sep 17 00:00:00 2001
From: Petr Matousek <pmatouse@redhat.com>
Date: Sun, 24 May 2015 10:53:44 +0200
Subject: [PATCH] pcnet: force the buffer access to be in bounds during tx

4096 is the maximum length per TMD and it is also currently the size of
the relay buffer pcnet driver uses for sending the packet data to QEMU
for further processing. With packet spanning multiple TMDs it can
happen that the overall packet size will be bigger than sizeof(buffer),
which results in memory corruption.

Fix this by only allowing to queue maximum sizeof(buffer) bytes.

This is CVE-2015-3209.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Reported-by: Matt Tait <matttait@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[BR: BSC#932770]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 hw/net/pcnet.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index bdfd38f..6d32e4c 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -1241,6 +1241,14 @@ static void pcnet_transmit(PCNetState *s)
         }
 
         bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
+
+        /* if multi-tmd packet outsizes s->buffer then skip it silently.
+           Note: this is not what real hw does */
+        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
+           s->xmit_pos = -1;
+           goto txdone;
+        }
+
         s->phys_mem_read(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
                          s->buffer + s->xmit_pos, bcnt, CSR_BSWP(s));
         s->xmit_pos += bcnt;

Places

File 0047-pcnet-force-the-buffer-access-to-be.patch of Package qemu (Revision ca3cc1d77de3a27238af7ca8b45956a9)

Places