[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] 01f7ce: slirp: udp: fix NULL pointer derefere

From: GitHub
Subject: [Qemu-commits] [qemu/qemu] 01f7ce: slirp: udp: fix NULL pointer dereference because o...
Date: Wed, 24 Sep 2014 04:00:05 -0700

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a
  Author: Petr Matousek <address@hidden>
  Date:   2014-09-23 (Tue, 23 Sep 2014)

  Changed paths:
    M slirp/udp.c

  Log Message:
  slirp: udp: fix NULL pointer dereference because of uninitialized socket

When guest sends udp packet with source port and source addr 0,
uninitialized socket is picked up when looking for matching and already
created udp sockets, and later passed to sosendto() where NULL pointer
dereference is hit during so->slirp->vnetwork_mask.s_addr access.

Fix this by checking that the socket is not just a socket stub.

This is CVE-2014-3640.

Signed-off-by: Petr Matousek <address@hidden>
Reported-by: Xavier Mehrenberger <address@hidden>
Reported-by: Stephane Duverger <address@hidden>
Reviewed-by: Jan Kiszka <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Michael Tokarev <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>

reply via email to

[Prev in Thread] Current Thread [Next in Thread]