]> git.ipfire.org Git - thirdparty/qemu.git/commit
slirp: check data length while emulating ident function
authorPrasad J Pandit <pjp@fedoraproject.org>
Sun, 13 Jan 2019 17:59:48 +0000 (23:29 +0530)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Tue, 30 Jul 2019 20:15:46 +0000 (15:15 -0500)
commit4e74e7a8674a8552bb3161aba8e4e992c59fd925
tree3eaa76b591f3e2c4e005d2e107bdcfa10fd0cad3
parent375667af787453a1678efdd4fe6e542924769779
slirp: check data length while emulating ident function

While emulating identification protocol, tcp_emu() does not check
available space in the 'sc_rcv->sb_data' buffer. It could lead to
heap buffer overflow issue. Add check to avoid it.

Reported-by: Kira <864786842@qq.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
(cherry picked from commit a7104eda7dab99d0cdbd3595c211864cba415905)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
slirp/tcp_subr.c