From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:45381) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Rv3m6-0006cI-9t for qemu-devel@nongnu.org; Wed, 08 Feb 2012 04:25:18 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Rv3lw-0006JQ-MM for qemu-devel@nongnu.org; Wed, 08 Feb 2012 04:25:14 -0500 Received: from goliath.siemens.de ([192.35.17.28]:31232) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Rv3lw-0006IT-CT for qemu-devel@nongnu.org; Wed, 08 Feb 2012 04:25:04 -0500 Message-ID: <4F323EED.4050207@siemens.com> Date: Wed, 08 Feb 2012 10:22:53 +0100 From: Jan Kiszka MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [PATCH] slirp: Prevent sending ICMP error replies to source-only addresses List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel Cc: Bjoern Bornemann , Roy Tam This triggered the related assert in arp_table_search. Signed-off-by: Jan Kiszka --- slirp/ip_icmp.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/slirp/ip_icmp.c b/slirp/ip_icmp.c index 4b43994..5dbf21d 100644 --- a/slirp/ip_icmp.c +++ b/slirp/ip_icmp.c @@ -262,6 +262,11 @@ icmp_error(struct mbuf *msrc, u_char type, u_char code, int minsize, #endif if(ip->ip_off & IP_OFFMASK) goto end_error; /* Only reply to fragment 0 */ + /* Do not reply to source-only IPs */ + if ((ip->ip_src.s_addr & htonl(~(0xf << 28))) == 0) { + goto end_error; + } + shlen=ip->ip_hl << 2; s_ip_len=ip->ip_len; if(ip->ip_p == IPPROTO_ICMP) { -- 1.7.3.4