dcavalca / rpms / qemu

Forked from rpms/qemu a year ago
Clone

Blame 0026-e1000-bounds-packet-size-against-buffer-size.patch

Justin M. Forbes 4d9bbd
From d0ed2d2e8e863a9a64c9fc9c08fa68bee546ad00 Mon Sep 17 00:00:00 2001
Justin M. Forbes 4d9bbd
From: Anthony Liguori <aliguori@us.ibm.com>
Justin M. Forbes 4d9bbd
Date: Mon, 23 Jan 2012 07:30:43 -0600
Justin M. Forbes 4d9bbd
Subject: [PATCH 26/26] e1000: bounds packet size against buffer size
Justin M. Forbes 4d9bbd
Justin M. Forbes 4d9bbd
Otherwise we can write beyond the buffer and corrupt memory.  This is tracked
Justin M. Forbes 4d9bbd
as CVE-2012-0029.
Justin M. Forbes 4d9bbd
Justin M. Forbes 4d9bbd
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Justin M. Forbes 4d9bbd
---
Justin M. Forbes 4d9bbd
 hw/e1000.c |    3 +++
Justin M. Forbes 4d9bbd
 1 files changed, 3 insertions(+), 0 deletions(-)
Justin M. Forbes 4d9bbd
Justin M. Forbes 4d9bbd
diff --git a/hw/e1000.c b/hw/e1000.c
Justin M. Forbes 4d9bbd
index 986ed9c..e164d79 100644
Justin M. Forbes 4d9bbd
--- a/hw/e1000.c
Justin M. Forbes 4d9bbd
+++ b/hw/e1000.c
Justin M. Forbes 4d9bbd
@@ -466,6 +466,8 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
Justin M. Forbes 4d9bbd
             bytes = split_size;
Justin M. Forbes 4d9bbd
             if (tp->size + bytes > msh)
Justin M. Forbes 4d9bbd
                 bytes = msh - tp->size;
Justin M. Forbes 4d9bbd
+
Justin M. Forbes 4d9bbd
+            bytes = MIN(sizeof(tp->data) - tp->size, bytes);
Justin M. Forbes 4d9bbd
             pci_dma_read(&s->dev, addr, tp->data + tp->size, bytes);
Justin M. Forbes 4d9bbd
             if ((sz = tp->size + bytes) >= hdr && tp->size < hdr)
Justin M. Forbes 4d9bbd
                 memmove(tp->header, tp->data, hdr);
Justin M. Forbes 4d9bbd
@@ -481,6 +483,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
Justin M. Forbes 4d9bbd
         // context descriptor TSE is not set, while data descriptor TSE is set
Justin M. Forbes 4d9bbd
         DBGOUT(TXERR, "TCP segmentaion Error\n");
Justin M. Forbes 4d9bbd
     } else {
Justin M. Forbes 4d9bbd
+        split_size = MIN(sizeof(tp->data) - tp->size, split_size);
Justin M. Forbes 4d9bbd
         pci_dma_read(&s->dev, addr, tp->data + tp->size, split_size);
Justin M. Forbes 4d9bbd
         tp->size += split_size;
Justin M. Forbes 4d9bbd
     }
Justin M. Forbes 4d9bbd
-- 
Justin M. Forbes 4d9bbd
1.7.7.6
Justin M. Forbes 4d9bbd