From abcd2baab187cc3b1fcce13b697da5874a123e39 Mon Sep 17 00:00:00 2001 From: aliguori Date: Fri, 27 Feb 2009 19:54:01 +0000 Subject: net socket verify packet size (Dustin Kirkland) net socket oversized packet This is a patch being carried by Ubuntu against kvm/qemu. Verify packet size before performing memcpy(). Signed-off-by: Dustin Kirkland Signed-off-by: Anthony Liguori git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6647 c046a42c-6fe2-441c-8c8c-71466251a162 --- net.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) (limited to 'net.c') diff --git a/net.c b/net.c index 29beb28..522df03 100644 --- a/net.c +++ b/net.c @@ -1093,8 +1093,8 @@ typedef struct NetSocketState { VLANClientState *vc; int fd; int state; /* 0 = getting length, 1 = getting data */ - int index; - int packet_len; + unsigned int index; + unsigned int packet_len; uint8_t buf[4096]; struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */ } NetSocketState; @@ -1127,7 +1127,8 @@ static void net_socket_receive_dgram(void *opaque, const uint8_t *buf, int size) static void net_socket_send(void *opaque) { NetSocketState *s = opaque; - int l, size, err; + int size, err; + unsigned l; uint8_t buf1[4096]; const uint8_t *buf; @@ -1166,7 +1167,15 @@ static void net_socket_send(void *opaque) l = s->packet_len - s->index; if (l > size) l = size; - memcpy(s->buf + s->index, buf, l); + if (s->index + l <= sizeof(s->buf)) { + memcpy(s->buf + s->index, buf, l); + } else { + fprintf(stderr, "serious error: oversized packet received," + "connection terminated.\n"); + s->state = 0; + goto eoc; + } + s->index += l; buf += l; size -= l; -- cgit v1.1