From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46036) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a3d8K-0006oQ-3E for qemu-devel@nongnu.org; Tue, 01 Dec 2015 00:05:48 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a3d8G-0000PR-Cw for qemu-devel@nongnu.org; Tue, 01 Dec 2015 00:05:43 -0500 References: <1448869103-16281-1-git-send-email-jasowang@redhat.com> <20151130124631-mutt-send-email-mst@redhat.com> From: Jason Wang Message-ID: <565D2A97.10208@redhat.com> Date: Tue, 1 Dec 2015 13:05:27 +0800 MIME-Version: 1.0 In-Reply-To: <20151130124631-mutt-send-email-mst@redhat.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH for 2.5 1/2] net: pcnet: add check to validate receive data size(CVE-2015-7504) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Michael S. Tsirkin" Cc: qemu-stable@nongnu.org, qemu-devel@nongnu.org, Prasad J Pandit On 11/30/2015 06:46 PM, Michael S. Tsirkin wrote: > On Mon, Nov 30, 2015 at 03:38:22PM +0800, Jason Wang wrote: >> From: Prasad J Pandit >> >> In loopback mode, pcnet_receive routine appends CRC code to the >> receive buffer. If the data size given is same as the buffer size, >> the appended CRC code overwrites 4 bytes after s->buffer. Added a >> check to avoid that. >> >> Reported by: Qinghao Tang >> Cc: qemu-stable@nongnu.org >> Signed-off-by: Prasad J Pandit >> Signed-off-by: Jason Wang > Reviewed-by: Michael S. Tsirkin Applied to my -net. Thanks >> --- >> hw/net/pcnet.c | 8 +++++--- >> 1 file changed, 5 insertions(+), 3 deletions(-) >> >> diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c >> index 0eb3cc4..309c40b 100644 >> --- a/hw/net/pcnet.c >> +++ b/hw/net/pcnet.c >> @@ -1084,7 +1084,7 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) >> uint32_t fcs = ~0; >> uint8_t *p = src; >> >> - while (p != &src[size-4]) >> + while (p != &src[size]) >> CRC(fcs, *p++); >> crc_err = (*(uint32_t *)p != htonl(fcs)); >> } >> @@ -1233,8 +1233,10 @@ static void pcnet_transmit(PCNetState *s) >> bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT); >> >> /* if multi-tmd packet outsizes s->buffer then skip it silently. >> - Note: this is not what real hw does */ >> - if (s->xmit_pos + bcnt > sizeof(s->buffer)) { >> + * Note: this is not what real hw does. >> + * Last four bytes of s->buffer are used to store CRC FCS code. >> + */ >> + if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) { >> s->xmit_pos = -1; >> goto txdone; >> } >> -- >> 2.5.0 >>