Commit 03247d43 authored by Stefan Hajnoczi's avatar Stefan Hajnoczi
Browse files

rtl8139: check IP Header Length field (CVE-2015-5165) 



The IP Header Length field was only checked in the IP checksum case, but
is used in other cases too.

Reported-by: default avatar朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parent e1c120a9

hw/net/rtl8139.c

+8 −11
Original line number Diff line number Diff line
@@ -2186,6 +2186,10 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) 
            }



            hlen = IP_HEADER_LENGTH(ip);

            if (hlen < sizeof(ip_header) || hlen > eth_payload_len) {

                goto skip_offload;

            }



            ip_protocol = ip->ip_p;

            ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
@@ -2193,18 +2197,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) 
            {

                DPRINTF("+++ C+ mode need IP checksum\n");



                if (hlen<sizeof(ip_header) || hlen>eth_payload_len) {/* min header length */

                    /* bad packet header len */

                    /* or packet too short */

                }

                else

                {

                ip->ip_sum = 0;

                ip->ip_sum = ip_checksum(ip, hlen);

                DPRINTF("+++ C+ mode IP header len=%d checksum=%04x\n",

                    hlen, ip->ip_sum);

            }

            }



            if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)

            {