commit e8e880a72e63d0587f03aa670be3de683b881ca8
author aurel32 <aurel32@c046a42c-6fe2-441c-8c8c-71466251a162> Sun Dec 07 18:15:23 2008 +0000
committer aurel32 <aurel32@c046a42c-6fe2-441c-8c8c-71466251a162> Sun Dec 07 18:15:23 2008 +0000
tree 1581368764d44d56922b384787971b36f1dd1494
parent a810a2de170565529464072edf2102443aaa9fab

slirp: fix CVE 2007-5729

The emulated network cards in QEMU allows local users to execute arbitrary
code by writing Ethernet frames with a size larger than the slirp's default
MTU, which triggers a heap-based buffer overflow in the slirp library.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5920 c046a42c-6fe2-441c-8c8c-71466251a162

slirp/slirp.c

diff --git a/slirp/slirp.c b/slirp/slirp.c
index de4b480..17b40e2 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -654,6 +654,9 @@
         if (!m)
             return;
         /* Note: we add to align the IP header */
+        if (M_FREEROOM(m) < pkt_len + 2) {
+            m_inc(m, pkt_len + 2);
+        }
         m->m_len = pkt_len + 2;
         memcpy(m->m_data + 2, pkt, pkt_len);