path: root/slirp
diff options
authorPetr Matousek <pmatouse@redhat.com>2014-09-18 08:35:37 +0200
committerPeter Maydell <peter.maydell@linaro.org>2014-09-23 19:15:05 +0100
commit01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a (patch)
treea3bb364b0bcc76ffcb54ed0acaa0f39fd382e997 /slirp
parent769188d3bbf95ce8d96a335624234dad083f4db6 (diff)
slirp: udp: fix NULL pointer dereference because of uninitialized socket
When guest sends udp packet with source port and source addr 0, uninitialized socket is picked up when looking for matching and already created udp sockets, and later passed to sosendto() where NULL pointer dereference is hit during so->slirp->vnetwork_mask.s_addr access. Fix this by checking that the socket is not just a socket stub. This is CVE-2014-3640. Signed-off-by: Petr Matousek <pmatouse@redhat.com> Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com> Reported-by: Stephane Duverger <stephane.duverger@eads.net> Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'slirp')
1 files changed, 1 insertions, 1 deletions
diff --git a/slirp/udp.c b/slirp/udp.c
index 8cc6cb66da..f77e00f5a0 100644
--- a/slirp/udp.c
+++ b/slirp/udp.c
@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen)
* Locate pcb for datagram.
so = slirp->udp_last_so;
- if (so->so_lport != uh->uh_sport ||
+ if (so == &slirp->udb || so->so_lport != uh->uh_sport ||
so->so_laddr.s_addr != ip->ip_src.s_addr) {
struct socket *tmp;