|
 |
383d26 |
From dec442886deeedfbcb0c9958403627bc11a8d9e9 Mon Sep 17 00:00:00 2001
|
|
|
383d26 |
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
|
|
|
383d26 |
Date: Mon, 20 May 2019 17:57:03 +0200
|
|
|
383d26 |
Subject: [PATCH 2/3] slirp: ensure there is enough space in mbuf to
|
|
|
383d26 |
null-terminate
|
|
|
383d26 |
MIME-Version: 1.0
|
|
|
383d26 |
Content-Type: text/plain; charset=UTF-8
|
|
|
383d26 |
Content-Transfer-Encoding: 8bit
|
|
|
383d26 |
|
|
|
383d26 |
RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
383d26 |
Message-id: <20190520175704.6250-3-marcandre.lureau@redhat.com>
|
|
|
383d26 |
Patchwork-id: 88109
|
|
|
383d26 |
O-Subject: [RHEL-7.7 qemu-kvm-rhev PATCH 2/3] slirp: ensure there is enough space in mbuf to null-terminate
|
|
|
383d26 |
Bugzilla: 1669071
|
|
|
383d26 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
383d26 |
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
383d26 |
RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
|
|
|
383d26 |
|
|
|
383d26 |
Prevents from buffer overflows.
|
|
|
383d26 |
Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1664205
|
|
|
383d26 |
|
|
|
383d26 |
Cc: Prasad J Pandit <pjp@fedoraproject.org>
|
|
|
383d26 |
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
383d26 |
|
|
|
383d26 |
(cherry picked from libslirp commit
|
|
|
383d26 |
306fef58b54d793ba4b259728c21322765bda917)
|
|
|
383d26 |
|
|
|
383d26 |
[ MA - backported with style conflicts fixes ]
|
|
|
383d26 |
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
383d26 |
|
|
|
383d26 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
383d26 |
---
|
|
|
383d26 |
slirp/tcp_subr.c | 3 +++
|
|
|
383d26 |
1 file changed, 3 insertions(+)
|
|
|
383d26 |
|
|
|
383d26 |
diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
|
|
|
383d26 |
index a61632d..a801a14 100644
|
|
|
383d26 |
--- a/slirp/tcp_subr.c
|
|
|
383d26 |
+++ b/slirp/tcp_subr.c
|
|
|
383d26 |
@@ -641,6 +641,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
|
|
|
383d26 |
memcpy(so_rcv->sb_wptr, m->m_data, m->m_len);
|
|
|
383d26 |
so_rcv->sb_wptr += m->m_len;
|
|
|
383d26 |
so_rcv->sb_rptr += m->m_len;
|
|
|
383d26 |
+ m_inc(m, m->m_len + 1);
|
|
|
383d26 |
m->m_data[m->m_len] = 0; /* NULL terminate */
|
|
|
383d26 |
if (strchr(m->m_data, '\r') || strchr(m->m_data, '\n')) {
|
|
|
383d26 |
if (sscanf(so_rcv->sb_data, "%u%*[ ,]%u", &n1, &n2) == 2) {
|
|
|
383d26 |
@@ -674,6 +675,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
|
|
|
383d26 |
}
|
|
|
383d26 |
|
|
|
383d26 |
case EMU_FTP: /* ftp */
|
|
|
383d26 |
+ m_inc(m, m->m_len + 1);
|
|
|
383d26 |
*(m->m_data+m->m_len) = 0; /* NUL terminate for strstr */
|
|
|
383d26 |
if ((bptr = (char *)strstr(m->m_data, "ORT")) != NULL) {
|
|
|
383d26 |
/*
|
|
|
383d26 |
@@ -771,6 +773,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
|
|
|
383d26 |
/*
|
|
|
383d26 |
* Need to emulate DCC CHAT, DCC SEND and DCC MOVE
|
|
|
383d26 |
*/
|
|
|
383d26 |
+ m_inc(m, m->m_len + 1);
|
|
|
383d26 |
*(m->m_data+m->m_len) = 0; /* NULL terminate the string for strstr */
|
|
|
383d26 |
if ((bptr = (char *)strstr(m->m_data, "DCC")) == NULL)
|
|
|
383d26 |
return 1;
|
|
|
383d26 |
--
|
|
|
383d26 |
1.8.3.1
|
|
|
383d26 |
|