Proxmox-Port/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2025-10-31 20:44:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
eed8a8f572
qemu/hw/net
History
Petr Matousek 9f7c594c00 pcnet: force the buffer access to be in bounds during tx 
4096 is the maximum length per TMD and it is also currently the size of
the relay buffer pcnet driver uses for sending the packet data to QEMU
for further processing. With packet spanning multiple TMDs it can
happen that the overall packet size will be bigger than sizeof(buffer),
which results in memory corruption.

Fix this by only allowing to queue maximum sizeof(buffer) bytes.

This is CVE-2015-3209.

[Fixed 3-space indentation to QEMU's 4-space coding standard.
--Stefan]

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Reported-by: Matt Tait <matttait@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-06-10 15:03:02 +01:00
..
fsl_etsec etsec: Replace qdev_init() by qdev_init_nofail() 2015-02-24 00:19:05 +01:00
rocker rocker: timestamp on the debug logs helps correlate with events in the VM 2015-05-11 14:49:04 +01:00
allwinner_emac.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
cadence_gem.c cadence_gem: Fix Rx buffer size field mask 2015-06-03 16:03:03 +03:00
dp8393x.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
e1000_regs.h e1000: improve auto-negotiation reporting via mii-tool 2014-06-23 17:38:00 +03:00
e1000.c hw/net/e1000: fix integer endianness 2015-03-27 10:23:50 +00:00
eepro100.c pci: Trivial device model conversions to realize 2015-02-26 12:42:16 +01:00
etraxfs_eth.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
lan9118.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
lance.c pcnet: pcnet_common_init() always returns 0, change to void 2015-02-26 12:42:16 +01:00
Makefile.objs rocker: add new rocker switch device 2015-05-11 14:49:04 +01:00
mcf_fec.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
milkymist-minimac2.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
mipsnet.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
ne2000-isa.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
ne2000.c pci: Trivial device model conversions to realize 2015-02-26 12:42:16 +01:00
ne2000.h ne2000: pass device to ne2000_setup_io, use it as owner 2013-07-04 17:42:46 +02:00
opencores_eth.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
pcnet-pci.c pcnet: Convert to realize 2015-02-26 12:42:17 +01:00
pcnet.c pcnet: force the buffer access to be in bounds during tx 2015-06-10 15:03:02 +01:00
pcnet.h pcnet: pcnet_common_init() always returns 0, change to void 2015-02-26 12:42:16 +01:00
rtl8139.c pci: Trivial device model conversions to realize 2015-02-26 12:42:16 +01:00
smc91c111.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
spapr_llan.c spapr_vio: Convert to realize() 2015-03-09 15:00:07 +01:00
stellaris_enet.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
vhost_net.c vhost-user: add multi queue support 2015-06-01 14:18:55 +02:00
virtio-net.c virtio: 64bit features fixups. 2015-06-03 18:19:16 +02:00
vmware_utils.h exec: Make stb_phys input an AddressSpace 2014-02-11 22:57:38 +10:00
vmxnet3.c pci: Trivial device model conversions to realize 2015-02-26 12:42:16 +01:00
vmxnet3.h vmxnet3: Eliminate __packed redefined warning 2013-09-06 17:25:55 +02:00
vmxnet_debug.h hw: move target-independent files to subdirectories 2013-04-08 18:13:12 +02:00
vmxnet_rx_pkt.c vmxnet: Remove unused function vmxnet_rx_pkt_get_num_frags() 2015-04-30 16:05:48 +03:00
vmxnet_rx_pkt.h vmxnet: Remove unused function vmxnet_rx_pkt_get_num_frags() 2015-04-30 16:05:48 +03:00
vmxnet_tx_pkt.c misc: Use g_assert_not_reached for code which is expected to be unreachable 2013-07-27 11:22:54 +04:00
vmxnet_tx_pkt.h hw: move target-independent files to subdirectories 2013-04-08 18:13:12 +02:00
xen_nic.c hw/net/xen_nic.c: Set 'netdev->mac' to NULL after free it 2015-01-12 10:16:23 +00:00
xgmac.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
xilinx_axienet.c net: remove all cleanup methods from NIC NetClientInfos 2015-01-12 10:16:23 +00:00
xilinx_ethlite.c xilinx_ethlite: Clean up after commit 2f991ad 2015-03-10 08:15:33 +03:00