Prasad J Pandit 413d463f43 slirp: check len against dhcp options array end ...

While parsing dhcp options string in 'dhcp_decode', if an options'
length 'len' appeared towards the end of 'bp_vend' array, ensuing
read could lead to an OOB memory access issue. Add check to avoid it.

This is CVE-2017-11434.

Reported-by: Reno Robert <renorobert@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

2017-08-03 00:26:44 +02:00

..

arp_table.c

…

bootp.c

slirp: check len against dhcp options array end

2017-08-03 00:26:44 +02:00

bootp.h

…

cksum.c

…

COPYRIGHT

…

debug.h

…

dhcpv6.c

…

dhcpv6.h

…

dnssearch.c

…

if.c

…

if.h

…

ip6_icmp.c

slirp: Send RDNSS in RA only if host has an IPv6 DNS server

2017-03-29 00:51:25 +02:00

ip6_icmp.h

…

ip6_input.c

…

ip6_output.c

…

ip6.h

slirp: use DIV_ROUND_UP

2017-07-15 14:28:25 +02:00

ip_icmp.c

slirp: fix pinging the virtual ipv4 DNS server

2017-04-29 18:29:58 +02:00

ip_icmp.h

…

ip_input.c

…

ip_output.c

…

ip.h

…

libslirp.h

…

main.h

…

Makefile.objs

slirp: add a fake NC-SI backend

2017-04-25 19:17:25 +08:00

mbuf.c

slirp: Convert mbufs to use g_malloc() and g_free()

2017-02-26 15:39:05 +01:00

mbuf.h

…

misc.c

slirp: fork_exec(): Don't close() a negative number in fork_exec()

2017-07-15 14:28:25 +02:00

misc.h

…

ncsi-pkt.h

slirp: add a fake NC-SI backend

2017-04-25 19:17:25 +08:00

ncsi.c

slirp: add a fake NC-SI backend

2017-04-25 19:17:25 +08:00

ndp_table.c

…

sbuf.c

slirp: Handle error returns from sosendoob()

2017-07-15 14:28:25 +02:00

sbuf.h

slirp: VMStatify sbuf

2017-04-29 18:44:16 +02:00

slirp_config.h

…

slirp.c

migration: Split registration functions from vmstate.h

2017-06-13 11:00:44 +02:00

slirp.h

slirp: add a fake NC-SI backend

2017-04-25 19:17:25 +08:00

socket.c

slirp: Handle error returns from sosendoob()

2017-07-15 14:28:25 +02:00

socket.h

slirp: VMStatify socket level

2017-04-29 18:44:16 +02:00

tcp_input.c

slirp: Fix wrong mss bug.

2017-05-27 23:34:47 +02:00

tcp_output.c

…

tcp_subr.c

Fix total IP header length in forwarded TCP packets

2017-05-27 23:35:00 +02:00

tcp_timer.c

…

tcp_timer.h

…

tcp_var.h

slirp: VMState conversion; tcpcb

2017-04-29 18:44:16 +02:00

tcp.h

…

tcpip.h

…

tftp.c

slirp: tftp, copy sockaddr_size

2017-04-29 18:29:58 +02:00

tftp.h

slirp: support dynamic block size for TFTP transfers

2016-12-21 00:02:15 +01:00

udp6.c

…

udp.c

slirp: Check qemu_socket() return value in udp_listen()

2017-02-26 15:38:38 +01:00

udp.h

…