Pablo Greco e6a3ae
From ad30988fde29143951447e7f973918eaa09c448c Mon Sep 17 00:00:00 2001
Pablo Greco e6a3ae
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Pablo Greco e6a3ae
Date: Wed, 24 Jul 2019 15:53:36 +0100
Pablo Greco e6a3ae
Subject: [PATCH 11/14] slirp: ensure there is enough space in mbuf to
Pablo Greco e6a3ae
 null-terminate
Pablo Greco e6a3ae
MIME-Version: 1.0
Pablo Greco e6a3ae
Content-Type: text/plain; charset=UTF-8
Pablo Greco e6a3ae
Content-Transfer-Encoding: 8bit
Pablo Greco e6a3ae
Pablo Greco e6a3ae
RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
Pablo Greco e6a3ae
Message-id: <20190724155337.25303-4-philmd@redhat.com>
Pablo Greco e6a3ae
Patchwork-id: 89678
Pablo Greco e6a3ae
O-Subject: [RHEL-8.1.0 qemu-kvm PATCH v2 3/4] slirp: ensure there is enough space in mbuf to null-terminate
Pablo Greco e6a3ae
Bugzilla: 1727642
Pablo Greco e6a3ae
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Pablo Greco e6a3ae
RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Pablo Greco e6a3ae
RH-Acked-by: Thomas Huth <thuth@redhat.com>
Pablo Greco e6a3ae
Pablo Greco e6a3ae
From: Marc-André Lureau <marcandre.lureau@redhat.com>
Pablo Greco e6a3ae
Pablo Greco e6a3ae
Prevents from buffer overflows.
Pablo Greco e6a3ae
Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1664205
Pablo Greco e6a3ae
Pablo Greco e6a3ae
Cc: Prasad J Pandit <pjp@fedoraproject.org>
Pablo Greco e6a3ae
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Pablo Greco e6a3ae
Pablo Greco e6a3ae
(cherry picked from libslirp commit
Pablo Greco e6a3ae
306fef58b54d793ba4b259728c21322765bda917)
Pablo Greco e6a3ae
Pablo Greco e6a3ae
[ MA - backported with style conflicts fixes ]
Pablo Greco e6a3ae
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Pablo Greco e6a3ae
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
Pablo Greco e6a3ae
(cherry picked from commit e80c12dfdbde349dcd225771a4801b47be0b3b5f)
Pablo Greco e6a3ae
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Pablo Greco e6a3ae
Pablo Greco e6a3ae
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
Pablo Greco e6a3ae
---
Pablo Greco e6a3ae
 slirp/tcp_subr.c | 3 +++
Pablo Greco e6a3ae
 1 file changed, 3 insertions(+)
Pablo Greco e6a3ae
Pablo Greco e6a3ae
diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
Pablo Greco e6a3ae
index 393447d..e245e0d 100644
Pablo Greco e6a3ae
--- a/slirp/tcp_subr.c
Pablo Greco e6a3ae
+++ b/slirp/tcp_subr.c
Pablo Greco e6a3ae
@@ -646,6 +646,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
Pablo Greco e6a3ae
 			memcpy(so_rcv->sb_wptr, m->m_data, m->m_len);
Pablo Greco e6a3ae
 			so_rcv->sb_wptr += m->m_len;
Pablo Greco e6a3ae
 			so_rcv->sb_rptr += m->m_len;
Pablo Greco e6a3ae
+			m_inc(m, m->m_len + 1);
Pablo Greco e6a3ae
 			m->m_data[m->m_len] = 0; /* NULL terminate */
Pablo Greco e6a3ae
 			if (strchr(m->m_data, '\r') || strchr(m->m_data, '\n')) {
Pablo Greco e6a3ae
 				if (sscanf(so_rcv->sb_data, "%u%*[ ,]%u", &n1, &n2) == 2) {
Pablo Greco e6a3ae
@@ -679,6 +680,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
Pablo Greco e6a3ae
 		}
Pablo Greco e6a3ae
 
Pablo Greco e6a3ae
         case EMU_FTP: /* ftp */
Pablo Greco e6a3ae
+		m_inc(m, m->m_len + 1);
Pablo Greco e6a3ae
                 *(m->m_data+m->m_len) = 0; /* NUL terminate for strstr */
Pablo Greco e6a3ae
 		if ((bptr = (char *)strstr(m->m_data, "ORT")) != NULL) {
Pablo Greco e6a3ae
 			/*
Pablo Greco e6a3ae
@@ -776,6 +778,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
Pablo Greco e6a3ae
 		/*
Pablo Greco e6a3ae
 		 * Need to emulate DCC CHAT, DCC SEND and DCC MOVE
Pablo Greco e6a3ae
 		 */
Pablo Greco e6a3ae
+		m_inc(m, m->m_len + 1);
Pablo Greco e6a3ae
 		*(m->m_data+m->m_len) = 0; /* NULL terminate the string for strstr */
Pablo Greco e6a3ae
 		if ((bptr = (char *)strstr(m->m_data, "DCC")) == NULL)
Pablo Greco e6a3ae
 			 return 1;
Pablo Greco e6a3ae
-- 
Pablo Greco e6a3ae
1.8.3.1
Pablo Greco e6a3ae