From: Li Qiang <liqiang...@360.cn> Vmxnet3 device emulator when parsing packet headers does not check for IP header length. It could lead to a OOB access when reading further packet data. Add check to avoid it.
Reported-by: Li Qiang <liqiang...@360.cn> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> Reviewed-by: Dmitry Fleytman <dmi...@daynix.com> Signed-off-by: Michael Roth <mdr...@linux.vnet.ibm.com> --- hw/net/vmxnet_tx_pkt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c index f4d0f5f..5ba2f5e 100644 --- a/hw/net/vmxnet_tx_pkt.c +++ b/hw/net/vmxnet_tx_pkt.c @@ -178,6 +178,11 @@ static bool vmxnet_tx_pkt_parse_headers(struct VmxnetTxPkt *pkt) } l3_hdr->iov_len = IP_HDR_GET_LEN(l3_hdr->iov_base); + if(l3_hdr->iov_len < sizeof(struct ip_header)) + { + l3_hdr->iov_len = 0; + return false; + } pkt->l4proto = ((struct ip_header *) l3_hdr->iov_base)->ip_p; /* copy optional IPv4 header data */ -- 1.9.1