mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-11-28 14:24:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

net socket verify packet size (Dustin Kirkland)

Browse Source 
net socket oversized packet

This is a patch being carried by Ubuntu against kvm/qemu.

Verify packet size before performing memcpy().

Signed-off-by: Dustin Kirkland <kirkland@canonical.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6647 c046a42c-6fe2-441c-8c8c-71466251a162
This commit is contained in:
aliguori 2009-02-27 19:54:01 +00:00
parent 31c05501c7
commit abcd2baab1
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net.c
View File

@ -1093,8 +1093,8 @@ typedef struct NetSocketState {
VLANClientState *vc; VLANClientState *vc;
int fd; int fd;
int state; /* 0 = getting length, 1 = getting data */ int state; /* 0 = getting length, 1 = getting data */
int index; unsigned int index;
int packet_len; unsigned int packet_len;
uint8_t buf[4096]; uint8_t buf[4096];
struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */ struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
} NetSocketState; } NetSocketState;
@ -1127,7 +1127,8 @@ static void net_socket_receive_dgram(void *opaque, const uint8_t *buf, int size)
static void net_socket_send(void *opaque) static void net_socket_send(void *opaque)
{ {
NetSocketState *s = opaque; NetSocketState *s = opaque;
int l, size, err; int size, err;
unsigned l;
uint8_t buf1[4096]; uint8_t buf1[4096];
const uint8_t *buf; const uint8_t *buf;
@ -1166,7 +1167,15 @@ static void net_socket_send(void *opaque)
l = s->packet_len - s->index; l = s->packet_len - s->index;
if (l > size) if (l > size)
l = size; l = size;
if (s->index + l <= sizeof(s->buf)) {
memcpy(s->buf + s->index, buf, l); memcpy(s->buf + s->index, buf, l);
} else {
fprintf(stderr, "serious error: oversized packet received,"
"connection terminated.\n");
s->state = 0;
goto eoc;
}
s->index += l; s->index += l;
buf += l; buf += l;
size -= l; size -= l;