<div dir="ltr"><div dir="ltr">Hi<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Nov 26, 2020 at 5:59 PM P J P <<a href="mailto:ppandit@redhat.com">ppandit@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">From: Prasad J Pandit <<a href="mailto:pjp@fedoraproject.org" target="_blank">pjp@fedoraproject.org</a>><br>
<br>
While processing ARP/NCSI packets in 'arp_input' or 'ncsi_input'<br>
routines, ensure that pkt_len is large enough to accommodate the<br>
respective protocol headers, lest it should do an OOB access.<br>
Add check to avoid it.<br>
<br>
Reported-by: Qiuhao Li <<a href="mailto:Qiuhao.Li@outlook.com" target="_blank">Qiuhao.Li@outlook.com</a>><br>
Signed-off-by: Prasad J Pandit <<a href="mailto:pjp@fedoraproject.org" target="_blank">pjp@fedoraproject.org</a>><br></blockquote><div><br></div><div>Weird that even basic fuzzing (with ASAN) didn't reach that.. we should investigate that further.</div><div><br></div><div>Reviewed-by: Marc-André Lureau <<a href="mailto:marcandre.lureau@redhat.com">marcandre.lureau@redhat.com</a>> <br></div><div><br></div><div>Is there a CVE?</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
---<br>
src/ncsi.c | 4 ++++<br>
src/slirp.c | 4 ++++<br>
2 files changed, 8 insertions(+)<br>
<br>
diff --git a/src/ncsi.c b/src/ncsi.c<br>
index 3c1dfef..75dcc08 100644<br>
--- a/src/ncsi.c<br>
+++ b/src/ncsi.c<br>
@@ -148,6 +148,10 @@ void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)<br>
uint32_t checksum;<br>
uint32_t *pchecksum;<br>
<br>
+ if (pkt_len < ETH_HLEN + sizeof(struct ncsi_pkt_hdr)) {<br>
+ return; /* packet too short */<br>
+ }<br>
+<br>
memset(ncsi_reply, 0, sizeof(ncsi_reply));<br>
<br>
memset(reh->h_dest, 0xff, ETH_ALEN);<br>
diff --git a/src/slirp.c b/src/slirp.c<br>
index 9bead0c..abb6f9a 100644<br>
--- a/src/slirp.c<br>
+++ b/src/slirp.c<br>
@@ -860,6 +860,10 @@ static void arp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)<br>
return;<br>
}<br>
<br>
+ if (pkt_len < ETH_HLEN + sizeof(struct slirp_arphdr)) {<br>
+ return; /* packet too short */<br>
+ }<br>
+<br>
ar_op = ntohs(ah->ar_op);<br>
switch (ar_op) {<br>
case ARPOP_REQUEST:<br>
-- <br>
2.28.0<br>
<br>
_______________________________________________<br>
Slirp mailing list<br>
<a href="mailto:Slirp@lists.freedesktop.org" target="_blank">Slirp@lists.freedesktop.org</a><br>
<a href="https://lists.freedesktop.org/mailman/listinfo/slirp" rel="noreferrer" target="_blank">https://lists.freedesktop.org/mailman/listinfo/slirp</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature">Marc-André Lureau<br></div></div>