aboutsummaryrefslogtreecommitdiff
path: root/slirp/socket.c
diff options
context:
space:
mode:
authorSteven Luo <steven+qemu@steven676.net>2016-04-06 22:04:32 -0700
committerSamuel Thibault <samuel.thibault@ens-lyon.org>2016-04-07 10:27:42 +0200
commitbfb1ac14029ee72b19296109fba880c0551755d5 (patch)
tree270d62cb3221dc7f5353f8e7d5198ec1d98fb295 /slirp/socket.c
parentb5ab677189b93efa4eaa921f42b21dc008247184 (diff)
downloadqemu-arm-bfb1ac14029ee72b19296109fba880c0551755d5.tar.gz
slirp: avoid use-after-free in slirp_pollfds_poll() if soread() returns an error
Samuel Thibault pointed out that it's possible that slirp_pollfds_poll() will try to use a socket even after soread() returns an error, resulting in an use-after-free if the socket was removed while handling the error. Avoid this by refusing to continue to work with the socket in this case. Signed-off-by: Steven Luo <steven+qemu@steven676.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Diffstat (limited to 'slirp/socket.c')
-rw-r--r--slirp/socket.c17
1 files changed, 11 insertions, 6 deletions
diff --git a/slirp/socket.c b/slirp/socket.c
index b836c42b8e..7f022a6769 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -260,10 +260,11 @@ err:
* so when OOB data arrives, we soread() it and everything
* in the send buffer is sent as urgent data
*/
-void
+int
sorecvoob(struct socket *so)
{
struct tcpcb *tp = sototcpcb(so);
+ int ret;
DEBUG_CALL("sorecvoob");
DEBUG_ARG("so = %p", so);
@@ -276,11 +277,15 @@ sorecvoob(struct socket *so)
* urgent data, or the read() doesn't return all the
* urgent data.
*/
- soread(so);
- tp->snd_up = tp->snd_una + so->so_snd.sb_cc;
- tp->t_force = 1;
- tcp_output(tp);
- tp->t_force = 0;
+ ret = soread(so);
+ if (ret > 0) {
+ tp->snd_up = tp->snd_una + so->so_snd.sb_cc;
+ tp->t_force = 1;
+ tcp_output(tp);
+ tp->t_force = 0;
+ }
+
+ return ret;
}
/*