1369de9828
CVE-2014-3689 vmware_vga: insufficient parameter validation in rectangle functions (bz #1153038, bz #1153035)
43 lines
1.6 KiB
Diff
43 lines
1.6 KiB
Diff
From: Petr Matousek <pmatouse@redhat.com>
|
|
Date: Thu, 18 Sep 2014 08:35:37 +0200
|
|
Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of
|
|
uninitialized socket
|
|
|
|
When guest sends udp packet with source port and source addr 0,
|
|
uninitialized socket is picked up when looking for matching and already
|
|
created udp sockets, and later passed to sosendto() where NULL pointer
|
|
dereference is hit during so->slirp->vnetwork_mask.s_addr access.
|
|
|
|
Fix this by checking that the socket is not just a socket stub.
|
|
|
|
This is CVE-2014-3640.
|
|
|
|
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
|
|
Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com>
|
|
Reported-by: Stephane Duverger <stephane.duverger@eads.net>
|
|
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
|
|
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
|
|
Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com
|
|
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
|
(cherry picked from commit 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a)
|
|
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
|
|
(cherry picked from commit 9a72433843d912a45046959b1953861211d1838d)
|
|
---
|
|
slirp/udp.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/slirp/udp.c b/slirp/udp.c
|
|
index b105f87..2188176 100644
|
|
--- a/slirp/udp.c
|
|
+++ b/slirp/udp.c
|
|
@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen)
|
|
* Locate pcb for datagram.
|
|
*/
|
|
so = slirp->udp_last_so;
|
|
- if (so->so_lport != uh->uh_sport ||
|
|
+ if (so == &slirp->udb || so->so_lport != uh->uh_sport ||
|
|
so->so_laddr.s_addr != ip->ip_src.s_addr) {
|
|
struct socket *tmp;
|
|
|