diff options
author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2021-06-04 16:34:30 +0400 |
---|---|---|
committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2021-06-14 11:42:40 +0400 |
commit | 3f17948137155f025f7809fdc38576d5d2451c3d (patch) | |
tree | 5a0bbb4d8c318689c27f175c6d53acedd9f2c1fb | |
parent | de71c15de66ba9350bf62c45b05f8fbff166517b (diff) | |
download | slirp-3f17948137155f025f7809fdc38576d5d2451c3d.zip slirp-3f17948137155f025f7809fdc38576d5d2451c3d.tar.gz slirp-3f17948137155f025f7809fdc38576d5d2451c3d.tar.bz2 |
tftp: check tftp_input buffer size
Fixes: CVE-2021-3595
Fixes: https://gitlab.freedesktop.org/slirp/libslirp/-/issues/46
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-rw-r--r-- | src/tftp.c | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -446,7 +446,11 @@ static void tftp_handle_error(Slirp *slirp, struct sockaddr_storage *srcsas, void tftp_input(struct sockaddr_storage *srcsas, struct mbuf *m) { - struct tftp_t *tp = (struct tftp_t *)m->m_data; + struct tftp_t *tp = mtod_check(m, offsetof(struct tftp_t, x.tp_buf)); + + if (tp == NULL) { + return; + } switch (ntohs(tp->tp_op)) { case TFTP_RRQ: |