From 8b98a2f07175d46c3f7217639bd5e03f2ec56343 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 30 Nov 2015 15:00:06 +0800 Subject: [PATCH] pcnet: fix rx buffer overflow(CVE-2015-7512) Backends could provide a packet whose length is greater than buffer size. Check for this and truncate the packet to avoid rx buffer overflow in this case. Cc: Prasad J Pandit Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin Signed-off-by: Jason Wang --- tools/qemu-xen-traditional/hw/pcnet.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/tools/qemu-xen-traditional/hw/pcnet.c b/tools/qemu-xen-traditional/hw/pcnet.c index 309c40b..1f4a3db 100644 --- a/tools/qemu-xen-traditional/hw/pcnet.c +++ b/tools/qemu-xen-traditional/hw/pcnet.c @@ -1064,6 +1064,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) int pktcount = 0; if (!s->looptest) { + if (size > 4092) { +#ifdef PCNET_DEBUG_RMD + fprintf(stderr, "pcnet: truncates rx packet.\n"); +#endif + size = 4092; + } memcpy(src, buf, size); /* no need to compute the CRC */ src[size] = 0; -- 1.7.0.4