slirp: correct size computation while concatenating mbuf

While reassembling incoming fragmented datagrams, 'm_cat' routine
extends the 'mbuf' buffer, if it has insufficient room. It computes
a wrong buffer size, which leads to overwriting adjacent heap buffer
area. Correct this size computation in m_cat.

Reported-by: ZDI Disclosures <zdi-disclosures@trendmicro.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

2 files changed, 8 insertions, 10 deletions

diff --git a/mbuf.c b/mbuf.c
index b11954d..46c4db1 100644
--- a/mbuf.c
+++ b/mbuf.c
@@ -133,7 +133,7 @@ void m_cat(struct mbuf *m, struct mbuf *n)
      * If there's no room, realloc
      */
     if (M_FREEROOM(m) < n->m_len)
-        m_inc(m, m->m_size + MINCSIZE);
+        m_inc(m, m->m_len + n->m_len);
 
     memcpy(m->m_data + m->m_len, n->m_data, n->m_len);
     m->m_len += n->m_len;
@@ -142,7 +142,7 @@ void m_cat(struct mbuf *m, struct mbuf *n)
 }
 
 
-/* make m size bytes large */
+/* make m 'size' bytes large from m_data */
 void m_inc(struct mbuf *m, int size)
 {
     int datasize;
@@ -153,12 +153,12 @@ void m_inc(struct mbuf *m, int size)
 
     if (m->m_flags & M_EXT) {
         datasize = m->m_data - m->m_ext;
-        m->m_ext = g_realloc(m->m_ext, size);
+        m->m_ext = g_realloc(m->m_ext, size + datasize);
         m->m_data = m->m_ext + datasize;
     } else {
         char *dat;
         datasize = m->m_data - m->m_dat;
-        dat = g_malloc(size);
+        dat = g_malloc(size + datasize);
         memcpy(dat, m->m_dat, m->m_size);
 
         m->m_ext = dat;
@@ -166,7 +166,7 @@ void m_inc(struct mbuf *m, int size)
         m->m_flags |= M_EXT;
     }
 
-    m->m_size = size;
+    m->m_size = size + datasize;
 }
 
 
diff --git a/mbuf.h b/mbuf.h
index c1147d1..ec396c8 100644
--- a/mbuf.h
+++ b/mbuf.h
@@ -33,8 +33,6 @@
 #ifndef MBUF_H
 #define MBUF_H
 
-#define MINCSIZE 4096 /* Amount to increase mbuf if too small */
-
 /*
  * Macros for type conversion
  * mtod(m,t) -	convert mbuf pointer to data pointer of correct type
@@ -71,11 +69,11 @@ struct mbuf {
     struct mbuf *m_prevpkt; /* Flags aren't used in the output queue */
     int m_flags; /* Misc flags */
 
-    int m_size; /* Size of data */
+    int m_size; /* Size of mbuf, from m_dat or m_ext */
     struct socket *m_so;
 
-    caddr_t m_data; /* Location of data */
-    int m_len; /* Amount of data in this mbuf */
+    caddr_t m_data; /* Current location of data */
+    int m_len; /* Amount of data in this mbuf, from m_data */
 
     Slirp *slirp;
     bool resolution_requested;