In net_tx_pkt_parse_headers() we examine the L2 and L3 headers one after the other. Add a sanity check that the two together don't exceed the packet length or the maximum IP packet size. This shouldn't happen if the L3 parsing was done right, but is worth doing for defence-in-depth.
Cc: [email protected] Fixes: e263cd49c73c595 ("Packet abstraction for VMWARE network devices") Signed-off-by: Peter Maydell <[email protected]> --- hw/net/net_tx_pkt.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c index dc2563721e8..c331628134e 100644 --- a/hw/net/net_tx_pkt.c +++ b/hw/net/net_tx_pkt.c @@ -267,6 +267,14 @@ static bool net_tx_pkt_parse_headers(struct NetTxPkt *pkt) break; } + if (l2_hdr->iov_len + l3_hdr->iov_len > ETH_MAX_IP_DGRAM_LEN || + l2_hdr->iov_len + l3_hdr->iov_len > + iov_size(pkt->raw, pkt->raw_frags)) { + l2_hdr->iov_len = 0; + l3_hdr->iov_len = 0; + return false; + } + net_tx_pkt_calculate_hdr_len(pkt); return true; } -- 2.43.0
