Attachment 291284 Details for Bug 360381 – The posted patch.

[patch] The posted patch.

xen-CVE-2007-5730.patch (text/plain), 1.76 KB, created by Bill Burns on 2008-01-10 14:47:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bill Burns

Created: 2008-01-10 14:47:04 UTC

Size: 1.76 KB

patch

obsolete

>#Heap-based buffer overflow in QEMU 0.8.2 allows local users to execute
>#arbitrary code via crafted data in the "net socket listen" option,
>#aka QEMU "net socket" heap overflow.  NOTE: some sources have used
>#CVE-2007-1321 to refer to this issue as part of "NE2000 network driver
>#and the socket code," but this is the correct identifier for the individual
>#net socket listen vulnerability.
>--- xen-3.1.0-src/tools/ioemu/vl.c.orig	2007-12-19 15:22:20.000000000 -0500
>+++ xen-3.1.0-src/tools/ioemu/vl.c	2007-12-19 15:35:57.000000000 -0500
>@@ -3303,8 +3303,8 @@ typedef struct NetSocketState {
>     VLANClientState *vc;
>     int fd;
>     int state; /* 0 = getting length, 1 = getting data */
>-    int index;
>-    int packet_len;
>+    unsigned int index;
>+    unsigned int packet_len;
>     uint8_t buf[4096];
>     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
> } NetSocketState;
>@@ -3335,7 +3335,8 @@ static void net_socket_receive_dgram(voi
> static void net_socket_send(void *opaque)
> {
>     NetSocketState *s = opaque;
>-    int l, size, err;
>+    int size, err;
>+    unsigned l;
>     uint8_t buf1[4096];
>     const uint8_t *buf;
> 
>@@ -3374,7 +3375,15 @@ static void net_socket_send(void *opaque
>             l = s->packet_len - s->index;
>             if (l > size)
>                 l = size;
>-            memcpy(s->buf + s->index, buf, l);
>+            if (s->index + l <= sizeof(s->buf)) {
>+                memcpy(s->buf + s->index, buf, l);
>+            } else {
>+                fprintf(stderr, "serious error: oversized packet received,"
>+                    "connection terminated.\n");
>+                s->state = 0;
>+                goto eoc;
>+            }
>+
>             s->index += l;
>             buf += l;
>             size -= l;

Actions: View | Diff

Attachments on bug 360381: 287621 | 291284