From nobody Wed Nov 5 18:41:20 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1536213033206581.139491840912; Wed, 5 Sep 2018 22:50:33 -0700 (PDT) Received: from localhost ([::1]:59481 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fxnBY-0002wP-6W for importer@patchew.org; Thu, 06 Sep 2018 01:50:32 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59270) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fxn8H-00087u-8Q for qemu-devel@nongnu.org; Thu, 06 Sep 2018 01:47:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fxn5N-0008WA-Vv for qemu-devel@nongnu.org; Thu, 06 Sep 2018 01:44:14 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:50558 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fxn5N-0008Um-NZ for qemu-devel@nongnu.org; Thu, 06 Sep 2018 01:44:09 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 54CB2402332F; Thu, 6 Sep 2018 05:44:09 +0000 (UTC) Received: from lemon.usersys.redhat.com (ovpn-12-55.pek2.redhat.com [10.72.12.55]) by smtp.corp.redhat.com (Postfix) with ESMTP id E7CE6202322A; Thu, 6 Sep 2018 05:44:02 +0000 (UTC) From: Fam Zheng To: qemu-devel@nongnu.org Date: Thu, 6 Sep 2018 13:43:38 +0800 Message-Id: <20180906054340.28988-3-famz@redhat.com> In-Reply-To: <20180906054340.28988-1-famz@redhat.com> References: <20180906054340.28988-1-famz@redhat.com> X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Thu, 06 Sep 2018 05:44:09 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Thu, 06 Sep 2018 05:44:09 +0000 (UTC) for IP:'10.11.54.4' DOMAIN:'int-mx04.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'famz@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v2 2/4] slirp: Add sanity check for str option length X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Thomas Huth , Fam Zheng , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Gerd Hoffmann , Samuel Thibault , Paolo Bonzini , =?UTF-8?q?Alex=20Benn=C3=A9e?= , Brad Smith Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RDMRC_1 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" When user provides a long domainname or hostname that doesn't fit in the DHCP packet, we mustn't overflow the response packet buffer. Instead, report errors, following the g_warning() in the slirp->vdnssearch branch. Also check the strlen against 256 when initializing slirp, which limit is also from the protocol where one byte represents the string length. This gives an early error before the warning which is harder to notice or diagnose. Reported-by: Thomas Huth Signed-off-by: Fam Zheng --- net/slirp.c | 9 +++++++++ slirp/bootp.c | 32 ++++++++++++++++++++++---------- 2 files changed, 31 insertions(+), 10 deletions(-) diff --git a/net/slirp.c b/net/slirp.c index 1e14318b4d..fd21dc728c 100644 --- a/net/slirp.c +++ b/net/slirp.c @@ -365,6 +365,15 @@ static int net_slirp_init(NetClientState *peer, const = char *model, return -1; } =20 + if (vdomainname && strlen(vdomainname) > 255) { + error_setg(errp, "'domainname' parameter cannot exceed 255 bytes"); + return -1; + } + + if (vhostname && strlen(vhostname) > 255) { + error_setg(errp, "'vhostname' parameter cannot exceed 255 bytes"); + return -1; + } =20 nc =3D qemu_new_net_client(&net_slirp_info, peer, model, name); =20 diff --git a/slirp/bootp.c b/slirp/bootp.c index 9e7b53ba94..1e8185f0ec 100644 --- a/slirp/bootp.c +++ b/slirp/bootp.c @@ -159,6 +159,7 @@ static void bootp_reply(Slirp *slirp, const struct boot= p_t *bp) struct in_addr preq_addr; int dhcp_msg_type, val; uint8_t *q; + uint8_t *end; uint8_t client_ethaddr[ETH_ALEN]; =20 /* extract exact DHCP msg type */ @@ -240,6 +241,7 @@ static void bootp_reply(Slirp *slirp, const struct boot= p_t *bp) rbp->bp_siaddr =3D saddr.sin_addr; /* Server IP address */ =20 q =3D rbp->bp_vend; + end =3D (uint8_t *)&rbp[1]; memcpy(q, rfc1533_cookie, 4); q +=3D 4; =20 @@ -292,24 +294,33 @@ static void bootp_reply(Slirp *slirp, const struct bo= otp_t *bp) =20 if (*slirp->client_hostname) { val =3D strlen(slirp->client_hostname); - *q++ =3D RFC1533_HOSTNAME; - *q++ =3D val; - memcpy(q, slirp->client_hostname, val); - q +=3D val; + if (q + val + 2 >=3D end) { + g_warning("DHCP packet size exceeded, " + "omitting host name option."); + } else { + *q++ =3D RFC1533_HOSTNAME; + *q++ =3D val; + memcpy(q, slirp->client_hostname, val); + q +=3D val; + } } =20 if (slirp->vdomainname) { val =3D strlen(slirp->vdomainname); - *q++ =3D RFC1533_DOMAINNAME; - *q++ =3D val; - memcpy(q, slirp->vdomainname, val); - q +=3D val; + if (q + val + 2 >=3D end) { + g_warning("DHCP packet size exceeded, " + "omitting domain name option."); + } else { + *q++ =3D RFC1533_DOMAINNAME; + *q++ =3D val; + memcpy(q, slirp->vdomainname, val); + q +=3D val; + } } =20 if (slirp->vdnssearch) { - size_t spaceleft =3D sizeof(rbp->bp_vend) - (q - rbp->bp_vend); val =3D slirp->vdnssearch_len; - if (val + 1 > spaceleft) { + if (q + val >=3D end) { g_warning("DHCP packet size exceeded, " "omitting domain-search option."); } else { @@ -331,6 +342,7 @@ static void bootp_reply(Slirp *slirp, const struct boot= p_t *bp) memcpy(q, nak_msg, sizeof(nak_msg) - 1); q +=3D sizeof(nak_msg) - 1; } + assert(q < end); *q =3D RFC1533_END; =20 daddr.sin_addr.s_addr =3D 0xffffffffu; --=20 2.17.1