In net_tx_pkt_tcp_fragment_init() we calculate the l4 header size by subtracting the packet's virt_hdr.hdr_len from its overall length, and then we g_malloc() that many bytes. This shouldn't underflow if the caller has been sanity checking sizes and offsets, but as defence-in-depth, check again here before relying on it for the malloc size.
This change would suffice to avoid the guest self-denial-of-service via overflowing the virt_hdr.hdr_len calculation in net_tx_pkt_tcp_fragment_init() which we fixed in the preceding commit. Cc: [email protected] Fixes: 02ef5fdc092bd4 ("hw/net/net_tx_pkt: Implement TCP segmentation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3648 Signed-off-by: Peter Maydell <[email protected]> --- hw/net/net_tx_pkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c index b2935900fe7..dc2563721e8 100644 --- a/hw/net/net_tx_pkt.c +++ b/hw/net/net_tx_pkt.c @@ -604,7 +604,7 @@ static bool net_tx_pkt_tcp_fragment_init(struct NetTxPkt *pkt, size_t bytes_read = 0; struct tcp_hdr *th; - if (!pkt->payload_frags) { + if (!pkt->payload_frags || pkt->virt_hdr.hdr_len <= pkt->hdr_len) { return false; } -- 2.43.0
