diff options
| author |   Stefan Hajnoczi <stefanha@redhat.com> | 2015-07-15 14:30:37 +0100 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2015-08-03 13:08:00 +0100 |
| commit | e1c120a9c54872f8a538ff9129d928de4e865cbd (patch) | |
| tree | f0c6ffaac0136110e74cc72a6d9299c37f04d859 /scripts/qapi-commands.py | |
| parent | rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165) (diff) | |
| download | qemu-e1c120a9c54872f8a538ff9129d928de4e865cbd.tar.xz qemu-e1c120a9c54872f8a538ff9129d928de4e865cbd.zip | |
rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
Transmit offload features access Ethernet and IP headers the packet. If
the packet is too short we must not attempt to access header fields:
int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
...
eth_payload_data = saved_buffer + ETH_HLEN;
...
ip = (ip_header*)eth_payload_data;
if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'scripts/qapi-commands.py')
0 files changed, 0 insertions, 0 deletions