cd9d161514
Fix systemtap tapsets (bz 831763) Fix qmp response race caused by spice server bug (bz 744015) Fix text mode screendumps (bz 819155) Don't renable ksm on update (bz 815156) Fix RPM install error on non-virt machines (bz 660629) Obsolete openbios to fix upgrade dependency issues (bz 694802)
46 lines
1.7 KiB
Diff
46 lines
1.7 KiB
Diff
From 078c531e6b57f36359b74ea6c136c2ea1b5a9891 Mon Sep 17 00:00:00 2001
|
|
From: Anthony Liguori <aliguori@us.ibm.com>
|
|
Date: Mon, 23 Jan 2012 07:30:43 -0600
|
|
Subject: [PATCH] e1000: bounds packet size against buffer size
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Otherwise we can write beyond the buffer and corrupt memory. This is tracked
|
|
as CVE-2012-0029.
|
|
|
|
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
|
|
(cherry picked from commit 65f82df0d7a71ce1b10cd4c5ab08888d176ac840)
|
|
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
[AF: stable-0.15 does not have pci_dma_read(). Fixes BNC#740165.]
|
|
Signed-off-by: Andreas Färber <afaerber@suse.de>
|
|
---
|
|
hw/e1000.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/hw/e1000.c b/hw/e1000.c
|
|
index 7971457..c91790b 100644
|
|
--- a/hw/e1000.c
|
|
+++ b/hw/e1000.c
|
|
@@ -472,6 +472,8 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
|
|
bytes = split_size;
|
|
if (tp->size + bytes > msh)
|
|
bytes = msh - tp->size;
|
|
+
|
|
+ bytes = MIN(sizeof(tp->data) - tp->size, bytes);
|
|
cpu_physical_memory_read(addr, tp->data + tp->size, bytes);
|
|
if ((sz = tp->size + bytes) >= hdr && tp->size < hdr)
|
|
memmove(tp->header, tp->data, hdr);
|
|
@@ -487,6 +489,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
|
|
// context descriptor TSE is not set, while data descriptor TSE is set
|
|
DBGOUT(TXERR, "TCP segmentaion Error\n");
|
|
} else {
|
|
+ split_size = MIN(sizeof(tp->data) - tp->size, split_size);
|
|
cpu_physical_memory_read(addr, tp->data + tp->size, split_size);
|
|
tp->size += split_size;
|
|
}
|
|
--
|
|
1.7.11.2
|
|
|