cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-slirp-check-sscanf-result-when-emulating-ident.patch

Pablo Greco e6a3ae
From 49fbfce352a678b538113598cba05c48281174a4 Mon Sep 17 00:00:00 2001
Pablo Greco e6a3ae
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Pablo Greco e6a3ae
Date: Wed, 24 Jul 2019 15:53:34 +0100
Pablo Greco e6a3ae
Subject: [PATCH 09/14] slirp: check sscanf result when emulating ident
Pablo Greco e6a3ae
MIME-Version: 1.0
Pablo Greco e6a3ae
Content-Type: text/plain; charset=UTF-8
Pablo Greco e6a3ae
Content-Transfer-Encoding: 8bit
Pablo Greco e6a3ae
Pablo Greco e6a3ae
RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
Pablo Greco e6a3ae
Message-id: <20190724155337.25303-2-philmd@redhat.com>
Pablo Greco e6a3ae
Patchwork-id: 89675
Pablo Greco e6a3ae
O-Subject: [RHEL-8.1.0 qemu-kvm PATCH v2 1/4] slirp: check sscanf result when emulating ident
Pablo Greco e6a3ae
Bugzilla: 1727642
Pablo Greco e6a3ae
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Pablo Greco e6a3ae
RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Pablo Greco e6a3ae
RH-Acked-by: Thomas Huth <thuth@redhat.com>
Pablo Greco e6a3ae
Pablo Greco e6a3ae
From: William Bowling <will@wbowling.info>
Pablo Greco e6a3ae
Pablo Greco e6a3ae
When emulating ident in tcp_emu, if the strchr checks passed but the
Pablo Greco e6a3ae
sscanf check failed, two uninitialized variables would be copied and
Pablo Greco e6a3ae
sent in the reply, so move this code inside the if(sscanf()) clause.
Pablo Greco e6a3ae
Pablo Greco e6a3ae
Signed-off-by: William Bowling <will@wbowling.info>
Pablo Greco e6a3ae
Cc: qemu-stable@nongnu.org
Pablo Greco e6a3ae
Cc: secalert@redhat.com
Pablo Greco e6a3ae
Message-Id: <1551476756-25749-1-git-send-email-will@wbowling.info>
Pablo Greco e6a3ae
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Pablo Greco e6a3ae
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Pablo Greco e6a3ae
(cherry picked from commit d3222975c7d6cda9e25809dea05241188457b113)
Pablo Greco e6a3ae
Fixes: CVE-2019-9824
Pablo Greco e6a3ae
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Pablo Greco e6a3ae
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
Pablo Greco e6a3ae
---
Pablo Greco e6a3ae
 slirp/tcp_subr.c | 10 +++++-----
Pablo Greco e6a3ae
 1 file changed, 5 insertions(+), 5 deletions(-)
Pablo Greco e6a3ae
Pablo Greco e6a3ae
diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
Pablo Greco e6a3ae
index 1c7eb28..af1b3eb 100644
Pablo Greco e6a3ae
--- a/slirp/tcp_subr.c
Pablo Greco e6a3ae
+++ b/slirp/tcp_subr.c
Pablo Greco e6a3ae
@@ -665,12 +665,12 @@ tcp_emu(struct socket *so, struct mbuf *m)
Pablo Greco e6a3ae
 							break;
Pablo Greco e6a3ae
 						}
Pablo Greco e6a3ae
 					}
Pablo Greco e6a3ae
+					so_rcv->sb_cc = snprintf(so_rcv->sb_data,
Pablo Greco e6a3ae
+								 so_rcv->sb_datalen,
Pablo Greco e6a3ae
+								 "%d,%d\r\n", n1, n2);
Pablo Greco e6a3ae
+					so_rcv->sb_rptr = so_rcv->sb_data;
Pablo Greco e6a3ae
+					so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc;
Pablo Greco e6a3ae
 				}
Pablo Greco e6a3ae
-                                so_rcv->sb_cc = snprintf(so_rcv->sb_data,
Pablo Greco e6a3ae
-                                                         so_rcv->sb_datalen,
Pablo Greco e6a3ae
-                                                         "%d,%d\r\n", n1, n2);
Pablo Greco e6a3ae
-				so_rcv->sb_rptr = so_rcv->sb_data;
Pablo Greco e6a3ae
-				so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc;
Pablo Greco e6a3ae
 			}
Pablo Greco e6a3ae
 			m_free(m);
Pablo Greco e6a3ae
 			return 0;
Pablo Greco e6a3ae
-- 
Pablo Greco e6a3ae
1.8.3.1
Pablo Greco e6a3ae