Re: SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

[Marc-André Lureau]

Hi

On Tue, Apr 21, 2020 at 11:18 AM Philippe Mathieu-Daudé
<address@hidden> wrote:
>
> Hi Samuel and Marc-André,
>
> Peter is going to tag 5.0-rc4 (final before release) today.
> Do you have plans to send a last minute pull-request to fix CVE-2020-1983?
>
> https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb

libslirp is not following qemu release schedule. The master branch has
a few changes that shouldn't be added to the release. We could create
version/stable/qemu branches, but then between each version, we would
end up with the submodule jumping between branches (with a non-linear
history). Is that the only option?

-- 
Marc-André Lureau