slirp: udp: fix NULL pointer dereference because of uninitialized socket

When guest sends udp packet with source port and source addr 0,
uninitialized socket is picked up when looking for matching and already
created udp sockets, and later passed to sosendto() where NULL pointer
dereference is hit during so->slirp->vnetwork_mask.s_addr access.

Fix this by checking that the socket is not just a socket stub.

This is CVE-2014-3640.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com>
Reported-by: Stephane Duverger <stephane.duverger@eads.net>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/slirp/udp.c b/slirp/udp.c
index 5b060f397bbb25b88e39f0557b265a11969ed406..7f98757a0b63c36772eb094adc1f97a16477a01b 100644 (file)
--- a/slirp/udp.c
+++ b/slirp/udp.c
@@ -144,7 +144,7 @@ udp_input(register struct mbuf *m, int iphlen)
         * Locate pcb for datagram.
         */
        so = slirp->udp_last_so;
-       if (so->so_lport != uh->uh_sport ||
+       if (so == &slirp->udb || so->so_lport != uh->uh_sport ||
            so->so_laddr.s_addr != ip->ip_src.s_addr) {
                struct socket *tmp;