|
 |
1072c8 |
From 52bf635da30c75d0fdb0a3e7e7b9a2483ca033fc Mon Sep 17 00:00:00 2001
|
|
|
1072c8 |
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
|
|
|
1072c8 |
Date: Thu, 29 Jul 2021 04:55:59 -0400
|
|
|
1072c8 |
Subject: [PATCH 05/14] Add mtod_check()
|
|
|
1072c8 |
MIME-Version: 1.0
|
|
|
1072c8 |
Content-Type: text/plain; charset=UTF-8
|
|
|
1072c8 |
Content-Transfer-Encoding: 8bit
|
|
|
1072c8 |
|
|
|
1072c8 |
RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
1072c8 |
Message-id: <20210708082537.1550263-2-marcandre.lureau@redhat.com>
|
|
|
1072c8 |
Patchwork-id: 101819
|
|
|
1072c8 |
O-Subject: [RHEL-8.5.0 qemu-kvm PATCH 1/8] Add mtod_check()
|
|
|
1072c8 |
Bugzilla: 1970819 1970835 1970843 1970853
|
|
|
1072c8 |
RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
|
|
|
1072c8 |
RH-Acked-by: Eric Blake <eblake@redhat.com>
|
|
|
1072c8 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
1072c8 |
|
|
|
1072c8 |
From: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
1072c8 |
|
|
|
1072c8 |
Recent security issues demonstrate the lack of safety care when casting
|
|
|
1072c8 |
a mbuf to a particular structure type. At least, it should check that
|
|
|
1072c8 |
the buffer is large enough. The following patches will make use of this
|
|
|
1072c8 |
function.
|
|
|
1072c8 |
|
|
|
1072c8 |
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
1072c8 |
|
|
|
1072c8 |
(cherry picked from commit 93e645e72a056ec0b2c16e0299fc5c6b94e4ca17)
|
|
|
1072c8 |
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
1072c8 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
1072c8 |
---
|
|
|
1072c8 |
slirp/src/mbuf.c | 11 +++++++++++
|
|
|
1072c8 |
slirp/src/mbuf.h | 1 +
|
|
|
1072c8 |
2 files changed, 12 insertions(+)
|
|
|
1072c8 |
|
|
|
1072c8 |
diff --git a/slirp/src/mbuf.c b/slirp/src/mbuf.c
|
|
|
1072c8 |
index 4fd62282a9..6d0653ed3d 100644
|
|
|
1072c8 |
--- a/slirp/src/mbuf.c
|
|
|
1072c8 |
+++ b/slirp/src/mbuf.c
|
|
|
1072c8 |
@@ -222,3 +222,14 @@ struct mbuf *dtom(Slirp *slirp, void *dat)
|
|
|
1072c8 |
|
|
|
1072c8 |
return (struct mbuf *)0;
|
|
|
1072c8 |
}
|
|
|
1072c8 |
+
|
|
|
1072c8 |
+void *mtod_check(struct mbuf *m, size_t len)
|
|
|
1072c8 |
+{
|
|
|
1072c8 |
+ if (m->m_len >= len) {
|
|
|
1072c8 |
+ return m->m_data;
|
|
|
1072c8 |
+ }
|
|
|
1072c8 |
+
|
|
|
1072c8 |
+ DEBUG_ERROR("mtod failed");
|
|
|
1072c8 |
+
|
|
|
1072c8 |
+ return NULL;
|
|
|
1072c8 |
+}
|
|
|
1072c8 |
diff --git a/slirp/src/mbuf.h b/slirp/src/mbuf.h
|
|
|
1072c8 |
index 546e7852c5..2015e3232f 100644
|
|
|
1072c8 |
--- a/slirp/src/mbuf.h
|
|
|
1072c8 |
+++ b/slirp/src/mbuf.h
|
|
|
1072c8 |
@@ -118,6 +118,7 @@ void m_inc(struct mbuf *, int);
|
|
|
1072c8 |
void m_adj(struct mbuf *, int);
|
|
|
1072c8 |
int m_copy(struct mbuf *, struct mbuf *, int, int);
|
|
|
1072c8 |
struct mbuf *dtom(Slirp *, void *);
|
|
|
1072c8 |
+void *mtod_check(struct mbuf *, size_t len);
|
|
|
1072c8 |
|
|
|
1072c8 |
static inline void ifs_init(struct mbuf *ifm)
|
|
|
1072c8 |
{
|
|
|
1072c8 |
--
|
|
|
1072c8 |
2.27.0
|
|
|
1072c8 |
|