Stefan Hajnoczi ce4f451bbb rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
Transmit offload features access Ethernet and IP headers the packet.  If
the packet is too short we must not attempt to access header fields:

  int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
  ...
  eth_payload_data = saved_buffer + ETH_HLEN;
  ...
  ip = (ip_header*)eth_payload_data;
  if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit e1c120a9c5)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-08-04 12:33:36 -05:00
2013-04-18 13:50:53 +02:00
2015-02-06 16:11:38 +00:00
2015-03-19 11:30:37 +03:00
2015-07-29 22:10:36 -05:00
2015-08-04 12:30:37 -05:00
2015-04-04 09:45:59 +03:00
2014-06-16 13:24:35 +02:00
2013-09-05 09:40:31 -05:00
2015-02-23 10:56:09 -05:00
2013-10-11 09:34:56 -07:00
2015-03-25 13:38:07 +01:00
2015-02-16 17:30:19 +01:00
2013-07-23 02:41:31 +02:00
2015-03-19 11:35:52 +03:00
2015-03-17 14:31:15 +01:00
2015-04-02 15:58:39 +02:00
2015-02-05 17:16:14 +01:00
2015-07-28 18:14:07 -05:00
2015-02-16 15:07:19 +00:00
2014-05-24 00:07:29 +04:00
2013-10-11 09:34:56 -07:00
2015-01-14 10:38:57 +01:00
2015-02-12 21:21:38 -08:00
2015-03-10 09:26:22 +01:00
2015-04-24 15:05:06 +01:00
2013-10-11 09:34:56 -07:00
2015-03-26 15:31:46 +01:00

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team
Description
No description provided
Readme 569 MiB
Languages
C 83%
C++ 6.3%
Python 3.2%
Dylan 2.9%
Shell 1.6%
Other 2.8%