| commit | e1c120a9c54872f8a538ff9129d928de4e865cbd | |
| author | Stefan Hajnoczi <stefanha@redhat.com> | |
| Wed, 15 Jul 2015 13:30:37 +0000 (15 14:30 +0100) | ||
| committer | Stefan Hajnoczi <stefanha@redhat.com> | |
| Mon, 3 Aug 2015 12:08:00 +0000 (3 13:08 +0100) | ||
| tree | f0c6ffaac0136110e74cc72a6d9299c37f04d859 | treesnapshot (tar.gz zip) |
| parent | d6812d60e7932de3cd0f602c0ee63dd3d09f1847 | commitdiff |
rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
Transmit offload features access Ethernet and IP headers the packet. If
the packet is too short we must not attempt to access header fields:
int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
...
eth_payload_data = saved_buffer + ETH_HLEN;
...
ip = (ip_header*)eth_payload_data;
if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Transmit offload features access Ethernet and IP headers the packet. If
the packet is too short we must not attempt to access header fields:
int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
...
eth_payload_data = saved_buffer + ETH_HLEN;
...
ip = (ip_header*)eth_payload_data;
if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| hw/net/rtl8139.c | diffblobblamehistory |