[Qemu-devel] [PATCH] net: check packet payload length

[P J P]

From: Prasad J Pandit <p...@fedoraproject.org>

While computing IP checksum, 'net_checksum_calculate' reads
payload length from the packet. It could exceed the given 'data'
buffer size. Add a check to avoid it.

Reported-by: Liu Ling <liuling...@360.cn>
Signed-off-by: Prasad J Pandit <p...@fedoraproject.org>
---
 net/checksum.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/checksum.c b/net/checksum.c
index 14c0855..e51698c 100644
--- a/net/checksum.c
+++ b/net/checksum.c
@@ -76,8 +76,9 @@ void net_checksum_calculate(uint8_t *data, int length)
        return;
     }
 
-    if (plen < csum_offset+2)
-       return;
+    if ((plen < csum_offset + 2) || (plen + hlen >= length)) {
+        return;
+    }
 
     data[14+hlen+csum_offset]   = 0;
     data[14+hlen+csum_offset+1] = 0;
-- 
2.5.0