merge fix for CVE-2019-14378

merge: slirp: Fix heap overflow in ip_reass on big packet input

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

diff --git a/debian/patches/extra/0004-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch b/debian/patches/extra/0004-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
new file mode 100644 (file)
index 0000000..5c9a60f
--- /dev/null
+++ b/debian/patches/extra/0004-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Sun, 28 Jul 2019 19:11:24 +0200
+Subject: [PATCH] Fix heap overflow in ip_reass on big packet input
+
+When the first fragment does not fit in the preallocated buffer, q will
+already be pointing to the ext buffer, so we mustn't try to update it.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+---
+ slirp/src/ip_input.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
+index a714fecd58..0ccb78317f 100644
+--- a/slirp/src/ip_input.c
++++ b/slirp/src/ip_input.c
+@@ -331,6 +331,8 @@ insert:
+     q = fp->frag_link.next;
+       m = dtom(slirp, q);
+ 
++      int was_ext = m->m_flags & M_EXT;
++
+       q = (struct ipasfrag *) q->ipf_next;
+       while (q != (struct ipasfrag*)&fp->frag_link) {
+         struct mbuf *t = dtom(slirp, q);
+@@ -353,7 +355,7 @@ insert:
+        * the old buffer (in the mbuf), so we must point ip
+        * into the new buffer.
+        */
+-      if (m->m_flags & M_EXT) {
++      if (!was_ext && m->m_flags & M_EXT) {
+         int delta = (char *)q - m->m_dat;
+         q = (struct ipasfrag *)(m->m_ext + delta);
+       }
+-- 
+2.20.1
+

diff --git a/debian/patches/series b/debian/patches/series
index 549bc52fc9c25f8d7c8d682e004d7122fbd3051c..ce96303d93896c28c63e1078650012c52ffceb85 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,6 +1,7 @@
 extra/0001-target-i386-add-MDS-NO-feature.patch
 extra/0002-target-i386-define-md-clear-bit.patch
 extra/0003-virtio-balloon-fix-QEMU-4.0-config-size-migration-in.patch
+extra/0004-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
 pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
 pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
 pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch