From 3bcddec301bcc3c251b4aab0446427de5fe35c57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Mon, 8 Jul 2019 15:50:30 +0100 Subject: [PATCH 3/7] slirp: ensure there is enough space in mbuf to null-terminate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Philippe Mathieu-Daudé Message-id: <20190708155031.7778-4-philmd@redhat.com> Patchwork-id: 89430 O-Subject: [RHEL-8.0.0 qemu-kvm PATCH 3/4] slirp: ensure there is enough space in mbuf to null-terminate Bugzilla: 1732324 RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Marc-André Lureau RH-Acked-by: Stefano Garzarella From: Marc-André Lureau Prevents from buffer overflows. Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1664205 Cc: Prasad J Pandit Signed-off-by: Marc-André Lureau (cherry picked from libslirp commit 306fef58b54d793ba4b259728c21322765bda917) [ MA - backported with style conflicts fixes ] Signed-off-by: Marc-André Lureau Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Danilo C. L. de Paula --- slirp/tcp_subr.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c index 393447d..e245e0d 100644 --- a/slirp/tcp_subr.c +++ b/slirp/tcp_subr.c @@ -646,6 +646,7 @@ tcp_emu(struct socket *so, struct mbuf *m) memcpy(so_rcv->sb_wptr, m->m_data, m->m_len); so_rcv->sb_wptr += m->m_len; so_rcv->sb_rptr += m->m_len; + m_inc(m, m->m_len + 1); m->m_data[m->m_len] = 0; /* NULL terminate */ if (strchr(m->m_data, '\r') || strchr(m->m_data, '\n')) { if (sscanf(so_rcv->sb_data, "%u%*[ ,]%u", &n1, &n2) == 2) { @@ -679,6 +680,7 @@ tcp_emu(struct socket *so, struct mbuf *m) } case EMU_FTP: /* ftp */ + m_inc(m, m->m_len + 1); *(m->m_data+m->m_len) = 0; /* NUL terminate for strstr */ if ((bptr = (char *)strstr(m->m_data, "ORT")) != NULL) { /* @@ -776,6 +778,7 @@ tcp_emu(struct socket *so, struct mbuf *m) /* * Need to emulate DCC CHAT, DCC SEND and DCC MOVE */ + m_inc(m, m->m_len + 1); *(m->m_data+m->m_len) = 0; /* NULL terminate the string for strstr */ if ((bptr = (char *)strstr(m->m_data, "DCC")) == NULL) return 1; -- 1.8.3.1