Commit 01f7cecf authored by Petr Matousek's avatar Petr Matousek Committed by Peter Maydell

slirp: udp: fix NULL pointer dereference because of uninitialized socket

When guest sends udp packet with source port and source addr 0,
uninitialized socket is picked up when looking for matching and already
created udp sockets, and later passed to sosendto() where NULL pointer
dereference is hit during so->slirp->vnetwork_mask.s_addr access.

Fix this by checking that the socket is not just a socket stub.

This is CVE-2014-3640.
Signed-off-by: default avatarPetr Matousek <pmatouse@redhat.com>
Reported-by: default avatarXavier Mehrenberger <xavier.mehrenberger@airbus.com>
Reported-by: default avatarStephane Duverger <stephane.duverger@eads.net>
Reviewed-by: default avatarJan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: default avatarMichael Tokarev <mjt@tls.msk.ru>
Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 769188d3
......@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen)
* Locate pcb for datagram.
*/
so = slirp->udp_last_so;
if (so->so_lport != uh->uh_sport ||
if (so == &slirp->udb || so->so_lport != uh->uh_sport ||
so->so_laddr.s_addr != ip->ip_src.s_addr) {
struct socket *tmp;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment