e0a4eb7219
CVE-2016-3712: out of bounds read in vga (bz #1334342) Fix USB redirection (bz #1330221) CVE-2016-4037: infinite loop in usb ehci (bz #1328080) CVE-2016-4001: buffer overflow in stellaris net (bz #1325885) CVE-2016-2858: rng stack corruption (bz #1314677) CVE-2016-2391: ohci: crash via multiple timers (bz #1308881) CVE-2016-2198: ehci: null pointer dereference (bz #1303134) Fix tpm passthrough (bz #1281413) Fix ./configure with ccache Ship sysctl file to fix s390x kvm (bz #1290589)
45 lines
1.5 KiB
Diff
45 lines
1.5 KiB
Diff
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Date: Fri, 8 Apr 2016 11:33:48 +0530
|
|
Subject: [PATCH] net: stellaris_enet: check packet length against receive
|
|
buffer
|
|
|
|
When receiving packets over Stellaris ethernet controller, it
|
|
uses receive buffer of size 2048 bytes. In case the controller
|
|
accepts large(MTU) packets, it could lead to memory corruption.
|
|
Add check to avoid it.
|
|
|
|
Reported-by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com>
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Message-id: 1460095428-22698-1-git-send-email-ppandit@redhat.com
|
|
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
|
|
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
|
(cherry picked from commit 3a15cc0e1ee7168db0782133d2607a6bfa422d66)
|
|
---
|
|
hw/net/stellaris_enet.c | 12 +++++++++++-
|
|
1 file changed, 11 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
|
|
index 21a4773..fc48ba8 100644
|
|
--- a/hw/net/stellaris_enet.c
|
|
+++ b/hw/net/stellaris_enet.c
|
|
@@ -235,8 +235,18 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si
|
|
n = s->next_packet + s->np;
|
|
if (n >= 31)
|
|
n -= 31;
|
|
- s->np++;
|
|
|
|
+ if (size >= sizeof(s->rx[n].data) - 6) {
|
|
+ /* If the packet won't fit into the
|
|
+ * emulated 2K RAM, this is reported
|
|
+ * as a FIFO overrun error.
|
|
+ */
|
|
+ s->ris |= SE_INT_FOV;
|
|
+ stellaris_enet_update(s);
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ s->np++;
|
|
s->rx[n].len = size + 6;
|
|
p = s->rx[n].data;
|
|
*(p++) = (size + 6);
|