Message ID | 20190802180449.10288-2-philmd@redhat.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | Backport of CVE-2019-14378 fix | expand |
On Fri, Aug 2, 2019 at 10:09 PM Philippe Mathieu-Daudé <philmd@redhat.com> wrote: > > From: Samuel Thibault <samuel.thibault@ens-lyon.org> > > When the first fragment does not fit in the preallocated buffer, q will > already be pointing to the ext buffer, so we mustn't try to update it. > > Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> > (cherry picked from libslirp commit 126c04acbabd7ad32c2b018fe10dfac2a3bc1210) > Fixes: CVE-2019-14378 > Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> thanks > --- > slirp/ip_input.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/slirp/ip_input.c b/slirp/ip_input.c > index 348e1dca5a..07d8808671 100644 > --- a/slirp/ip_input.c > +++ b/slirp/ip_input.c > @@ -334,6 +334,8 @@ insert: > q = fp->frag_link.next; > m = dtom(slirp, q); > > + int was_ext = m->m_flags & M_EXT; > + > q = (struct ipasfrag *) q->ipf_next; > while (q != (struct ipasfrag*)&fp->frag_link) { > struct mbuf *t = dtom(slirp, q); > @@ -356,7 +358,7 @@ insert: > * the old buffer (in the mbuf), so we must point ip > * into the new buffer. > */ > - if (m->m_flags & M_EXT) { > + if (!was_ext && m->m_flags & M_EXT) { > int delta = (char *)q - m->m_dat; > q = (struct ipasfrag *)(m->m_ext + delta); > } > -- > 2.20.1 > >
diff --git a/slirp/ip_input.c b/slirp/ip_input.c index 348e1dca5a..07d8808671 100644 --- a/slirp/ip_input.c +++ b/slirp/ip_input.c @@ -334,6 +334,8 @@ insert: q = fp->frag_link.next; m = dtom(slirp, q); + int was_ext = m->m_flags & M_EXT; + q = (struct ipasfrag *) q->ipf_next; while (q != (struct ipasfrag*)&fp->frag_link) { struct mbuf *t = dtom(slirp, q); @@ -356,7 +358,7 @@ insert: * the old buffer (in the mbuf), so we must point ip * into the new buffer. */ - if (m->m_flags & M_EXT) { + if (!was_ext && m->m_flags & M_EXT) { int delta = (char *)q - m->m_dat; q = (struct ipasfrag *)(m->m_ext + delta); }