From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41032) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X4Z6D-0004Rm-I2 for qemu-devel@nongnu.org; Tue, 08 Jul 2014 13:23:19 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X4Z5h-0000Im-5P for qemu-devel@nongnu.org; Tue, 08 Jul 2014 13:22:37 -0400 Received: from e37.co.us.ibm.com ([32.97.110.158]:35091) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X4Z5g-0000I5-TG for qemu-devel@nongnu.org; Tue, 08 Jul 2014 13:22:05 -0400 Received: from /spool/local by e37.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 8 Jul 2014 11:22:04 -0600 From: Michael Roth Date: Tue, 8 Jul 2014 12:17:57 -0500 Message-Id: <1404839947-1086-87-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1404839947-1086-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1404839947-1086-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 086/156] curl: check data size before memcpy to local buffer. (CVE-2014-0144) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org From: Fam Zheng curl_read_cb is callback function for libcurl when data arrives. The data size passed in here is not guaranteed to be within the range of request we submitted, so we may overflow the guest IO buffer. Check the real size we have before memcpy to buffer to avoid overflow. Signed-off-by: Fam Zheng Reviewed-by: Stefan Hajnoczi Signed-off-by: Kevin Wolf Reviewed-by: Max Reitz Signed-off-by: Stefan Hajnoczi (cherry picked from commit 6d4b9e55fc625514a38d27cff4b9933f617fa7dc) Signed-off-by: Michael Roth --- block/curl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/block/curl.c b/block/curl.c index 1c04dcc..47cf70a 100644 --- a/block/curl.c +++ b/block/curl.c @@ -157,6 +157,11 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque) if (!s || !s->orig_buf) goto read_end; + if (s->buf_off >= s->buf_len) { + /* buffer full, read nothing */ + return 0; + } + realsize = MIN(realsize, s->buf_len - s->buf_off); memcpy(s->orig_buf + s->buf_off, ptr, realsize); s->buf_off += realsize; -- 1.9.1