random-mirrors/smaeul-u-boot
1
0
Fork 0
mirror of https://github.com/smaeul/u-boot.git synced 2025-11-04 05:50:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

CVE: net: fix unbounded memcpy of UDP packet

Browse Source 
This patch adds a check to udp_len to fix unbounded memcpy for
CVE-2019-14192, CVE-2019-14193 and CVE-2019-14199.

Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reviewed-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This commit is contained in:
liucheng (G) 2019-08-29 13:47:33 +00:00 committed by Joe Hershberger
parent 12c2a310e8
commit fe7288069d
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/net.c
View File

@ -1264,6 +1264,9 @@ void net_process_received_packet(uchar *in_packet, int len)
return; return;
} }
if (ntohs(ip->udp_len) < UDP_HDR_SIZE || ntohs(ip->udp_len) > ntohs(ip->ip_len))
return;
debug_cond(DEBUG_DEV_PKT, debug_cond(DEBUG_DEV_PKT,
"received UDP (to=%pI4, from=%pI4, len=%d)\n", "received UDP (to=%pI4, from=%pI4, len=%d)\n",
&dst_ip, &src_ip, len); &dst_ip, &src_ip, len);