Commit 74572be4 authored by Marc-André Lureau's avatar Marc-André Lureau
Browse files

udp: check upd_input buffer size

Fixes: CVE-2021-3594
Fixes: https://gitlab.freedesktop.org/slirp/libslirp/-/issues/47

Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
parent 990163cf
......@@ -96,7 +96,10 @@ void udp_input(register struct mbuf *m, int iphlen)
/*
* Get IP and UDP header together in first mbuf.
*/
ip = mtod(m, struct ip *);
ip = mtod_check(m, iphlen + sizeof(struct udphdr));
if (ip == NULL) {
goto bad;
}
uh = (struct udphdr *)((char *)ip + iphlen);
/*
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment