On Fri, Aug 2, 2019 at 10:09 PM Philippe Mathieu-Daudé
<phi...@redhat.com> wrote:
>
> From: Samuel Thibault <samuel.thiba...@ens-lyon.org>
>
> When the first fragment does not fit in the preallocated buffer, q will
> already be pointing to the ext buffer, so we mustn't try to update it.
>
> Signed-off-by: Samuel Thibault <samuel.thiba...@ens-lyon.org>
> (cherry picked from libslirp commit 126c04acbabd7ad32c2b018fe10dfac2a3bc1210)
> Fixes: CVE-2019-14378
> Signed-off-by: Philippe Mathieu-Daudé <phi...@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com>
thanks
> ---
> slirp/ip_input.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/slirp/ip_input.c b/slirp/ip_input.c
> index 348e1dca5a..07d8808671 100644
> --- a/slirp/ip_input.c
> +++ b/slirp/ip_input.c
> @@ -334,6 +334,8 @@ insert:
> q = fp->frag_link.next;
> m = dtom(slirp, q);
>
> + int was_ext = m->m_flags & M_EXT;
> +
> q = (struct ipasfrag *) q->ipf_next;
> while (q != (struct ipasfrag*)&fp->frag_link) {
> struct mbuf *t = dtom(slirp, q);
> @@ -356,7 +358,7 @@ insert:
> * the old buffer (in the mbuf), so we must point ip
> * into the new buffer.
> */
> - if (m->m_flags & M_EXT) {
> + if (!was_ext && m->m_flags & M_EXT) {
> int delta = (char *)q - m->m_dat;
> q = (struct ipasfrag *)(m->m_ext + delta);
> }
> --
> 2.20.1
>
>
--
Marc-André Lureau
