aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSamuel Thibault <samuel.thibault@ens-lyon.org>2020-01-08 23:16:38 +0000
committerSamuel Thibault <samuel.thibault@ens-lyon.org>2020-01-08 23:16:38 +0000
commit3fc6296bfe3a1ded2ed8ab3b17f2e9cdd8cedad7 (patch)
tree764002a25445957f4420e6d0e9189f5319a44996
parent789955c6e1cf5a9ed722138fea5fc8ffd4cbfbd1 (diff)
parent2655fffed7a9e765bcb4701dd876e9dab975f289 (diff)
downloadslirp-3fc6296bfe3a1ded2ed8ab3b17f2e9cdd8cedad7.zip
slirp-3fc6296bfe3a1ded2ed8ab3b17f2e9cdd8cedad7.tar.gz
slirp-3fc6296bfe3a1ded2ed8ab3b17f2e9cdd8cedad7.tar.bz2
Merge branch 'oob' into 'master'
tcp_emu: Fix oob access See merge request slirp/libslirp!27
-rw-r--r--CHANGELOG.md1
-rw-r--r--src/tcp_subr.c7
2 files changed, 8 insertions, 0 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 00d0ce2..5cf94a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Fixed
- ncsi: fix checksum OOB memory access
+ - `tcp_emu()`: fix OOB accesses
## [4.1.0] - 2019-12-02
diff --git a/src/tcp_subr.c b/src/tcp_subr.c
index 382aa38..9c1bdec 100644
--- a/src/tcp_subr.c
+++ b/src/tcp_subr.c
@@ -871,6 +871,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
break;
case 5:
+ if (bptr == m->m_data + m->m_len - 1)
+ return 1; /* We need two bytes */
+
/*
* The difference between versions 1.0 and
* 2.0 is here. For future versions of
@@ -886,6 +889,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
/* This is the field containing the port
* number that RA-player is listening to.
*/
+
+ if (bptr == m->m_data + m->m_len - 1)
+ return 1; /* We need two bytes */
+
lport = (((uint8_t *)bptr)[0] << 8) + ((uint8_t *)bptr)[1];
if (lport < 6970)
lport += 256; /* don't know why */