[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/2] slirp: ensure there is enough space in mbuf to
From: |
Marc-André Lureau |
Subject: |
[Qemu-devel] [PATCH 1/2] slirp: ensure there is enough space in mbuf to null-terminate |
Date: |
Thu, 18 Apr 2019 14:59:07 +0200 |
Prevents from buffer overflows.
Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1664205
Cc: Prasad J Pandit <address@hidden>
Signed-off-by: Marc-André Lureau <address@hidden>
---
slirp/src/tcp_subr.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
index fde9207b0c..c43598de48 100644
--- a/slirp/src/tcp_subr.c
+++ b/slirp/src/tcp_subr.c
@@ -644,6 +644,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
memcpy(so_rcv->sb_wptr, m->m_data, m->m_len);
so_rcv->sb_wptr += m->m_len;
so_rcv->sb_rptr += m->m_len;
+ m_inc(m, m->m_len + 1);
m->m_data[m->m_len] = 0; /* NULL terminate */
if (strchr(m->m_data, '\r') || strchr(m->m_data, '\n'))
{
if (sscanf(so_rcv->sb_data, "%u%*[ ,]%u", &n1,
&n2) == 2) {
@@ -677,6 +678,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
}
case EMU_FTP: /* ftp */
+ m_inc(m, m->m_len + 1);
*(m->m_data+m->m_len) = 0; /* NUL terminate for strstr */
if ((bptr = (char *)strstr(m->m_data, "ORT")) != NULL) {
/*
@@ -774,6 +776,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
/*
* Need to emulate DCC CHAT, DCC SEND and DCC MOVE
*/
+ m_inc(m, m->m_len + 1);
*(m->m_data+m->m_len) = 0; /* NULL terminate the string for
strstr */
if ((bptr = (char *)strstr(m->m_data, "DCC")) == NULL)
return 1;
--
2.21.0.313.ge35b8cb8e2