Prasad J Pandit d0ee85b4e4 net: check packet payload length ...

While computing IP checksum, 'net_checksum_calculate' reads
payload length from the packet. It could exceed the given 'data'
buffer size. Add a check to avoid it.

Reported-by: Liu Ling <liuling-it@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 362786f14a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

2016-03-22 17:40:27 -05:00

..

checksum.c

net: check packet payload length

2016-03-22 17:40:27 -05:00

clients.h

net: Permit incremental conversion of init functions to Error

2015-05-27 09:51:04 +01:00

dump.c

net/dump: fix nfds->filename leak

2016-03-17 16:34:15 -05:00

eth.c

misc: Use g_assert_not_reached for code which is expected to be unreachable

2013-07-27 11:22:54 +04:00

filter-buffer.c

netfilter: add a netbuffer filter

2015-10-12 13:31:28 +08:00

filter.c

net/filter: fix nf->netdev_id leak

2016-03-17 16:34:23 -05:00

hub.c

net: Convert to new qapi union layout

2015-11-02 08:30:27 +01:00

hub.h

net: fix qemu_flush_queued_packets() in presence of a hub

2013-02-27 16:10:23 +01:00

l2tpv3.c

net: Convert to new qapi union layout

2015-11-02 08:30:27 +01:00

Makefile.objs

netfilter: add a netbuffer filter

2015-10-12 13:31:28 +08:00

net.c

net: Convert to new qapi union layout

2015-11-02 08:30:27 +01:00

netmap.c

net: netmap: use error_setg() helpers in place of error_report()

2015-11-12 15:31:52 +08:00

queue.c

net/queue: export qemu_net_queue_append_iov

2015-10-12 13:31:18 +08:00

slirp.c

net: Convert to new qapi union layout

2015-11-02 08:30:27 +01:00

socket.c

net: Convert to new qapi union layout

2015-11-02 08:30:27 +01:00

tap_int.h

tap: add VNET_LE/VNET_BE operations

2015-06-17 17:12:54 +02:00

tap-aix.c

tap: fix non-linux build

2015-06-19 12:17:25 +02:00

tap-bsd.c

tap-bsd: use user-specified tap device if it already exists

2015-11-06 15:42:38 +03:00

tap-haiku.c

tap: fix non-linux build

2015-06-19 12:17:25 +02:00

tap-linux.c

trivial: remove trailing newline from error_report

2015-09-11 10:21:38 +03:00

tap-linux.h

tap: add VNET_LE/VNET_BE operations

2015-06-17 17:12:54 +02:00

tap-solaris.c

tap: fix non-linux build

2015-06-19 12:17:25 +02:00

tap-win32.c

tap-win32: disable broken async write path

2015-11-27 10:39:55 +08:00

tap.c

net: Convert to new qapi union layout

2015-11-02 08:30:27 +01:00

util.c

net: reorganize headers

2012-12-19 08:31:29 +01:00

util.h

net: move parse_macaddr() to net/util.[ch]

2009-12-03 09:41:34 -06:00

vde.c

net: Convert to new qapi union layout

2015-11-02 08:30:27 +01:00

vhost-user.c

vhost-user: verify that number of queues is non-zero

2015-12-02 16:42:27 +02:00