提交 abcd2baa 编写于 作者: A aliguori

net socket verify packet size (Dustin Kirkland)

net socket oversized packet

This is a patch being carried by Ubuntu against kvm/qemu.

Verify packet size before performing memcpy().
Signed-off-by: NDustin Kirkland <kirkland@canonical.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6647 c046a42c-6fe2-441c-8c8c-71466251a162
上级 31c05501
......@@ -1093,8 +1093,8 @@ typedef struct NetSocketState {
VLANClientState *vc;
int fd;
int state; /* 0 = getting length, 1 = getting data */
int index;
int packet_len;
unsigned int index;
unsigned int packet_len;
uint8_t buf[4096];
struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
} NetSocketState;
......@@ -1127,7 +1127,8 @@ static void net_socket_receive_dgram(void *opaque, const uint8_t *buf, int size)
static void net_socket_send(void *opaque)
{
NetSocketState *s = opaque;
int l, size, err;
int size, err;
unsigned l;
uint8_t buf1[4096];
const uint8_t *buf;
......@@ -1166,7 +1167,15 @@ static void net_socket_send(void *opaque)
l = s->packet_len - s->index;
if (l > size)
l = size;
if (s->index + l <= sizeof(s->buf)) {
memcpy(s->buf + s->index, buf, l);
} else {
fprintf(stderr, "serious error: oversized packet received,"
"connection terminated.\n");
s->state = 0;
goto eoc;
}
s->index += l;
buf += l;
size -= l;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册