debian/patches/extra/0001-net-check-fragment-length-during-fragmentation.patch

   1 From 24a01bab4aa431b79e201c1e2d0ac552a41114bc Mon Sep 17 00:00:00 2001
   2 From: Prasad J Pandit <pjp@fedoraproject.org>
   3 Date: Thu, 4 Aug 2016 13:00:14 +0530
   4 Subject: [PATCH 1/5] net: check fragment length during fragmentation
   5
   6 Network transport abstraction layer supports packet fragmentation.
   7 While fragmenting a packet, it checks for more fragments from
   8 packet length and current fragment length. It is susceptible
   9 to an infinite loop, if the current fragment length is zero.
  10 Add check to avoid it.
  11
  12 Reported-by: Li Qiang <liqiang6-s@360.cn>
  13 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  14 Reviewed-by: Dmitry Fleytman <dmitry@daynix.com>
  15 CC: qemu-stable@nongnu.org
  16 Signed-off-by: Jason Wang <jasowang@redhat.com>
  17 ---
  18  hw/net/vmxnet_tx_pkt.c | 2 +-
  19  1 file changed, 1 insertion(+), 1 deletion(-)
  20
  21 diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c
  22 index 91e1e08..f4d0f5f 100644
  23 --- a/hw/net/vmxnet_tx_pkt.c
  24 +++ b/hw/net/vmxnet_tx_pkt.c
  25 @@ -544,7 +544,7 @@ static bool vmxnet_tx_pkt_do_sw_fragmentation(struct VmxnetTxPkt *pkt,
  26
  27          fragment_offset += fragment_len;
  28
  29 -    } while (more_frags);
  30 +    } while (fragment_len && more_frags);
  31
  32      return true;
  33  }
  34 --
  35 2.1.4
  36