Google GitGoogle Git
Sign in
qemu/qemu/5d85a09554fb66e18107cfbfa4e6b637bf4e2508
commit
5d85a09554fb66e18107cfbfa4e6b637bf4e2508
[log]
author
Laurent Vivier <lvivier@redhat.com>
Wed Jul 22 13:50:08 2026 +0200
committer
Michael S. Tsirkin <mst@redhat.com>
Fri Sep 11 15:54:46 2026 -0400
tree
99ef5b2df7c533ee5744eef25eb288d95a541e69
parent
63c8024432efd587e8e135c73a1ed3c3ce0dc8be [diff]
hw/net/virtio-net: check packet size before VLAN tag access in receive_filter()

receive_filter() reads ptr[14..15] to extract the VLAN ID without
checking the packet is large enough. A short frame with VLAN TPID
at bytes 12-13 but no VLAN TCI causes a 2-byte out-of-bounds read.

Add size checks before accessing the Ethernet header and the VLAN
tag fields.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3788
Fixes: f21c0ed97c97 ("qemu:virtio-net: Add VLAN filtering (Alex Williamson)")
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260722115008.1570510-1-lvivier@redhat.com>
1 file changed
tree: 99ef5b2df7c533ee5744eef25eb288d95a541e69
  1. .github/
  2. .gitlab/
  3. .gitlab-ci.d/
  4. accel/
  5. audio/
  6. authz/
  7. backends/
  8. block/
  9. bsd-user/
  10. chardev/
  11. common-user/
  12. configs/
  13. contrib/
  14. crypto/
  15. disas/
  16. docs/
  17. dump/
  18. ebpf/
  19. fpu/
  20. fsdev/
  21. gdbstub/
  22. host/
  23. hw/
  24. include/
  25. io/
  26. libdecnumber/
  27. linux-headers/
  28. linux-user/
  29. migration/
  30. monitor/
  31. nbd/
  32. net/
  33. pc-bios/
  34. plugins/
  35. po/
  36. python/
  37. pyvenv/
  38. qapi/
  39. qga/
  40. qobject/
  41. qom/
  42. replay/
  43. roms/
  44. rust/
  45. scripts/
  46. scsi/
  47. semihosting/
  48. stats/
  49. storage-daemon/
  50. stubs/
  51. subprojects/
  52. system/
  53. target/
  54. tcg/
  55. tests/
  56. tools/
  57. trace/
  58. ui/
  59. util/
  60. .b4-config
  61. .dir-locals.el
  62. .editorconfig
  63. .exrc
  64. .gdbinit
  65. .git-blame-ignore-revs
  66. .gitattributes
  67. .gitignore
  68. .gitlab-ci.yml
  69. .gitlab-map-auto
  70. .gitlab-map-manual
  71. .gitmodules
  72. .gitpublish
  73. .mailmap
  74. .patchew.yml
  75. .readthedocs.yml
  76. .travis.yml
  77. block.c
  78. blockdev-nbd.c
  79. blockdev.c
  80. blockjob.c
  81. Cargo.lock
  82. Cargo.toml
  83. clippy.toml
  84. configure
  85. COPYING
  86. COPYING.LIB
  87. cpu-common.c
  88. cpu-target.c
  89. event-loop-base.c
  90. gitdm.config
  91. hmp-commands-info.hx
  92. hmp-commands.hx
  93. iothread.c
  94. job-qmp.c
  95. job.c
  96. Kconfig
  97. Kconfig.host
  98. LICENSE
  99. MAINTAINERS
  100. Makefile
  101. meson.build
  102. meson_options.txt
  103. module-common.c
  104. os-posix.c
  105. os-wasm.c
  106. os-win32.c
  107. page-vary-common.c
  108. page-vary-system.c
  109. pythondeps.toml
  110. qemu-bridge-helper.c
  111. qemu-edid.c
  112. qemu-img-cmds.hx
  113. qemu-img.c
  114. qemu-io-cmds.c
  115. qemu-io.c
  116. qemu-keymap.c
  117. qemu-nbd.c
  118. qemu-options.hx
  119. qemu.nsi
  120. qemu.sasl
  121. README.rst
  122. replication.c
  123. run.in
  124. target-info-qom.c
  125. target-info-stub.c
  126. target-info.c
  127. trace-events
  128. VERSION
  129. version.rc