summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZac Medico <zmedico@gentoo.org>2020-11-26 12:50:17 -0800
committerZac Medico <zmedico@gentoo.org>2020-11-26 12:52:42 -0800
commitd30c6855d7a1a594e6259685a4dc22e1bb6acf93 (patch)
tree17dbdf2ec9bd6b9e24de8269e24121cb77cde001 /net-libs/libslirp/files
parentapp-admin/whowatch: drop old EAPI (diff)
downloadgentoo-d30c6855d7a1a594e6259685a4dc22e1bb6acf93.tar.gz
gentoo-d30c6855d7a1a594e6259685a4dc22e1bb6acf93.tar.bz2
gentoo-d30c6855d7a1a594e6259685a4dc22e1bb6acf93.zip
net-libs/libslirp: Revbump to 4.3.1-r1
Fixes CVE-2020-29129 and CVE-2020-29130. Bug: https://bugs.gentoo.org/756910 Package-Manager: Portage-3.0.10, Repoman-3.0.2 Signed-off-by: Zac Medico <zmedico@gentoo.org>
Diffstat (limited to 'net-libs/libslirp/files')
-rw-r--r--net-libs/libslirp/files/libslirp-4.3.1-bug-756910-check-pkt_len.patch48
1 files changed, 48 insertions, 0 deletions
diff --git a/net-libs/libslirp/files/libslirp-4.3.1-bug-756910-check-pkt_len.patch b/net-libs/libslirp/files/libslirp-4.3.1-bug-756910-check-pkt_len.patch
new file mode 100644
index 00000000000..aef7f19ba13
--- /dev/null
+++ b/net-libs/libslirp/files/libslirp-4.3.1-bug-756910-check-pkt_len.patch
@@ -0,0 +1,48 @@
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Thu, 26 Nov 2020 13:57:06 +0000
+Subject: [PATCH] slirp: check pkt_len before reading protocol header
+
+While processing ARP/NCSI packets in 'arp_input' or 'ncsi_input'
+routines, ensure that pkt_len is large enough to accommodate the
+respective protocol headers, lest it should do an OOB access.
+Add check to avoid it.
+
+Reported-by: Qiuhao Li @outlook.com;
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+---
+ src/ncsi.c | 4 ++++
+ src/slirp.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/src/ncsi.c b/src/ncsi.c
+index 3c1dfef..75dcc08 100644
+--- a/src/ncsi.c
++++ b/src/ncsi.c
+@@ -148,6 +148,10 @@ void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
+ uint32_t checksum;
+ uint32_t *pchecksum;
+
++ if (pkt_len < ETH_HLEN + sizeof(struct ncsi_pkt_hdr)) {
++ return; /* packet too short */
++ }
++
+ memset(ncsi_reply, 0, sizeof(ncsi_reply));
+
+ memset(reh->h_dest, 0xff, ETH_ALEN);
+diff --git a/src/slirp.c b/src/slirp.c
+index 9bead0c..abb6f9a 100644
+--- a/src/slirp.c
++++ b/src/slirp.c
+@@ -860,6 +860,10 @@ static void arp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
+ return;
+ }
+
++ if (pkt_len < ETH_HLEN + sizeof(struct slirp_arphdr)) {
++ return; /* packet too short */
++ }
++
+ ar_op = ntohs(ah->ar_op);
+ switch (ar_op) {
+ case ARPOP_REQUEST:
+--
+2.28.0