[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] net: check packet payload length
From: |
P J P |
Subject: |
Re: [Qemu-devel] [PATCH] net: check packet payload length |
Date: |
Wed, 24 Feb 2016 10:07:54 +0530 (IST) |
+-- On Wed, 24 Feb 2016, Jason Wang wrote --+
| > - hw/net/virtio-net.c
| > if (size > 27 && size < 1500) &&
| > (buf[34] == 0 && buf[35] == 67)) {
|
| Are we sure size of buf is >= 35 here?
No; I'm yet to see why it checks for > 27. If (27 < size < 34) then we have
another OOB access there.
| > + if (len < 14+20)
| > + return;
|
| Ok.
I have sent a revised v2 of this patch.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
- [Qemu-devel] [PATCH] net: check packet payload length, P J P, 2016/02/17
- Re: [Qemu-devel] [PATCH] net: check packet payload length, Markus Armbruster, 2016/02/17
- Re: [Qemu-devel] [PATCH] net: check packet payload length, P J P, 2016/02/17
- Re: [Qemu-devel] [PATCH] net: check packet payload length, P J P, 2016/02/18
- Re: [Qemu-devel] [PATCH] net: check packet payload length, Markus Armbruster, 2016/02/18
- Re: [Qemu-devel] [PATCH] net: check packet payload length, P J P, 2016/02/18
- Re: [Qemu-devel] [PATCH] net: check packet payload length, Jason Wang, 2016/02/23
- Re: [Qemu-devel] [PATCH] net: check packet payload length, P J P, 2016/02/23
- Re: [Qemu-devel] [PATCH] net: check packet payload length, Jason Wang, 2016/02/23
- Re: [Qemu-devel] [PATCH] net: check packet payload length,
P J P <=