Stefan Hajnoczi e1c120a9c5 rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)
Transmit offload features access Ethernet and IP headers the packet.  If
the packet is too short we must not attempt to access header fields:

  int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
  ...
  eth_payload_data = saved_buffer + ETH_HLEN;
  ...
  ip = (ip_header*)eth_payload_data;
  if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {

Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-08-03 13:08:00 +01:00
2015-07-08 13:11:01 +02:00
2015-07-28 13:22:57 +01:00
2015-07-07 14:54:55 +02:00
2015-07-09 15:20:40 +02:00
2015-07-28 14:19:16 +01:00
2015-07-24 13:57:44 +02:00
2015-07-14 21:50:13 -04:00
2015-07-27 22:44:47 +03:00
2015-07-07 09:22:40 +01:00
2015-07-14 17:15:23 +02:00
2015-07-27 22:44:47 +03:00
2015-07-27 22:44:47 +03:00
2015-07-24 13:57:45 +02:00
2015-07-24 13:57:45 +02:00
2015-07-24 13:57:45 +02:00
2015-07-29 18:50:11 +01:00
2015-06-23 17:46:20 +01:00

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team
Description
No description provided
Readme 404 MiB
Languages
C 82.6%
C++ 6.5%
Python 3.4%
Dylan 2.9%
Shell 1.6%
Other 2.8%