slirp: correct size computation while concatenating mbuf
While reassembling incoming fragmented datagrams, 'm_cat' routine extends the 'mbuf' buffer, if it has insufficient room. It computes a wrong buffer size, which leads to overwriting adjacent heap buffer area. Correct this size computation in m_cat. Reported-by: ZDI Disclosures <zdi-disclosures@trendmicro.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
This commit is contained in:
parent
3835c310bd
commit
864036e251
11
slirp/mbuf.c
11
slirp/mbuf.c
|
@ -138,7 +138,7 @@ m_cat(struct mbuf *m, struct mbuf *n)
|
|||
* If there's no room, realloc
|
||||
*/
|
||||
if (M_FREEROOM(m) < n->m_len)
|
||||
m_inc(m,m->m_size+MINCSIZE);
|
||||
m_inc(m, m->m_len + n->m_len);
|
||||
|
||||
memcpy(m->m_data+m->m_len, n->m_data, n->m_len);
|
||||
m->m_len += n->m_len;
|
||||
|
@ -147,7 +147,7 @@ m_cat(struct mbuf *m, struct mbuf *n)
|
|||
}
|
||||
|
||||
|
||||
/* make m size bytes large */
|
||||
/* make m 'size' bytes large from m_data */
|
||||
void
|
||||
m_inc(struct mbuf *m, int size)
|
||||
{
|
||||
|
@ -158,12 +158,12 @@ m_inc(struct mbuf *m, int size)
|
|||
|
||||
if (m->m_flags & M_EXT) {
|
||||
datasize = m->m_data - m->m_ext;
|
||||
m->m_ext = g_realloc(m->m_ext, size);
|
||||
m->m_ext = g_realloc(m->m_ext, size + datasize);
|
||||
m->m_data = m->m_ext + datasize;
|
||||
} else {
|
||||
char *dat;
|
||||
datasize = m->m_data - m->m_dat;
|
||||
dat = g_malloc(size);
|
||||
dat = g_malloc(size + datasize);
|
||||
memcpy(dat, m->m_dat, m->m_size);
|
||||
|
||||
m->m_ext = dat;
|
||||
|
@ -171,8 +171,7 @@ m_inc(struct mbuf *m, int size)
|
|||
m->m_flags |= M_EXT;
|
||||
}
|
||||
|
||||
m->m_size = size;
|
||||
|
||||
m->m_size = size + datasize;
|
||||
}
|
||||
|
||||
|
||||
|
|
|
@ -33,8 +33,6 @@
|
|||
#ifndef MBUF_H
|
||||
#define MBUF_H
|
||||
|
||||
#define MINCSIZE 4096 /* Amount to increase mbuf if too small */
|
||||
|
||||
/*
|
||||
* Macros for type conversion
|
||||
* mtod(m,t) - convert mbuf pointer to data pointer of correct type
|
||||
|
@ -72,11 +70,11 @@ struct mbuf {
|
|||
struct mbuf *m_prevpkt; /* Flags aren't used in the output queue */
|
||||
int m_flags; /* Misc flags */
|
||||
|
||||
int m_size; /* Size of data */
|
||||
int m_size; /* Size of mbuf, from m_dat or m_ext */
|
||||
struct socket *m_so;
|
||||
|
||||
caddr_t m_data; /* Location of data */
|
||||
int m_len; /* Amount of data in this mbuf */
|
||||
caddr_t m_data; /* Current location of data */
|
||||
int m_len; /* Amount of data in this mbuf, from m_data */
|
||||
|
||||
Slirp *slirp;
|
||||
bool resolution_requested;
|
||||
|
|
Loading…
Reference in a new issue