From: Bruce Rogers <brogers@novell.com>
Date: Sat, 5 Feb 2011 21:47:56 +0000 (-0700)
Subject: PATCH] slirp: fix buffer overrun
X-Git-Tag: v0.14.0-rc2~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bd2483faf127abe9fa5abc3c8e199f5e7d6534d3;p=thirdparty%2Fqemu.git

PATCH] slirp: fix buffer overrun

Since the addition of the slirp member to struct mbuf, the value of
SLIRP_MSIZE and the initialization of m_size have not been correct,
resulting in overrunning the end of the malloc'd buffer in some cases.

Signed-off-by: Bruce Rogers <brogers@novell.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
---

diff --git a/slirp/mbuf.c b/slirp/mbuf.c
index 87508ba0131..eadc8022415 100644
--- a/slirp/mbuf.c
+++ b/slirp/mbuf.c
@@ -23,7 +23,7 @@
  * Find a nice value for msize
  * XXX if_maxlinkhdr already in mtu
  */
-#define SLIRP_MSIZE (IF_MTU + IF_MAXLINKHDR + sizeof(struct m_hdr ) + 6)
+#define SLIRP_MSIZE (IF_MTU + IF_MAXLINKHDR + offsetof(struct mbuf, m_dat) + 6)
 
 void
 m_init(Slirp *slirp)
@@ -65,7 +65,7 @@ m_get(Slirp *slirp)
 	m->m_flags = (flags | M_USEDLIST);
 
 	/* Initialise it */
-	m->m_size = SLIRP_MSIZE - sizeof(struct m_hdr);
+	m->m_size = SLIRP_MSIZE - offsetof(struct m_hdr, m_dat);
 	m->m_data = m->m_dat;
 	m->m_len = 0;
         m->m_nextpkt = NULL;