Brad Bishop | 1a4b7ee | 2018-12-16 17:11:34 -0800 | [diff] [blame^] | 1 | From e5ff72a8005dd1d9c0f63f8a9cc4298df5bb7551 Mon Sep 17 00:00:00 2001 |
| 2 | From: Changqing Li <changqing.li@windriver.com> |
| 3 | Date: Mon, 15 Oct 2018 16:39:46 +0800 |
| 4 | Subject: [PATCH] pcnet: fix possible buffer overflow |
| 5 | |
| 6 | In pcnet_receive(), we try to assign size_ to size which converts from |
| 7 | size_t to integer. This will cause troubles when size_ is greater |
| 8 | INT_MAX, this will lead a negative value in size and it can then pass |
| 9 | the check of size < MIN_BUF_SIZE which may lead out of bound access |
| 10 | for both buf and buf1. |
| 11 | |
| 12 | Fixing by converting the type of size to size_t. |
| 13 | |
| 14 | CC: address@hidden |
| 15 | Reported-by: Daniel Shapira <address@hidden> |
| 16 | Reviewed-by: Michael S. Tsirkin <address@hidden> |
| 17 | Signed-off-by: Jason Wang <address@hidden> |
| 18 | |
| 19 | Upstream-Status: Backport [https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03268.html] |
| 20 | |
| 21 | CVE: CVE-2018-17963 |
| 22 | |
| 23 | Signed-off-by: Changqing Li <changqing.li@windriver.com> |
| 24 | --- |
| 25 | hw/net/pcnet.c | 4 ++-- |
| 26 | 1 file changed, 2 insertions(+), 2 deletions(-) |
| 27 | |
| 28 | diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c |
| 29 | index 0c44554..d9ba04b 100644 |
| 30 | --- a/hw/net/pcnet.c |
| 31 | +++ b/hw/net/pcnet.c |
| 32 | @@ -988,14 +988,14 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) |
| 33 | uint8_t buf1[60]; |
| 34 | int remaining; |
| 35 | int crc_err = 0; |
| 36 | - int size = size_; |
| 37 | + size_t size = size_; |
| 38 | |
| 39 | if (CSR_DRX(s) || CSR_STOP(s) || CSR_SPND(s) || !size || |
| 40 | (CSR_LOOP(s) && !s->looptest)) { |
| 41 | return -1; |
| 42 | } |
| 43 | #ifdef PCNET_DEBUG |
| 44 | - printf("pcnet_receive size=%d\n", size); |
| 45 | + printf("pcnet_receive size=%zu\n", size); |
| 46 | #endif |
| 47 | |
| 48 | /* if too small buffer, then expand it */ |
| 49 | -- |
| 50 | 2.7.4 |
| 51 | |