From: Petr Matousek Date: Thu, 18 Sep 2014 06:35:37 +0000 (+0200) Subject: slirp: udp: fix NULL pointer dereference because of uninitialized socket X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=17f77d73cec4dd4178e95c6b1abd2fa87daaef78;p=qemu-upstream-4.3-testing.git slirp: udp: fix NULL pointer dereference because of uninitialized socket When guest sends udp packet with source port and source addr 0, uninitialized socket is picked up when looking for matching and already created udp sockets, and later passed to sosendto() where NULL pointer dereference is hit during so->slirp->vnetwork_mask.s_addr access. Fix this by checking that the socket is not just a socket stub. This is CVE-2014-3640. Signed-off-by: Petr Matousek Reported-by: Xavier Mehrenberger Reported-by: Stephane Duverger Reviewed-by: Jan Kiszka Reviewed-by: Michael S. Tsirkin Reviewed-by: Michael Tokarev Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com Signed-off-by: Peter Maydell --- diff --git a/slirp/udp.c b/slirp/udp.c index 9286cb7d3..e748b444b 100644 --- a/slirp/udp.c +++ b/slirp/udp.c @@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) * Locate pcb for datagram. */ so = slirp->udp_last_so; - if (so->so_lport != uh->uh_sport || + if (so == &slirp->udb || so->so_lport != uh->uh_sport || so->so_laddr.s_addr != ip->ip_src.s_addr) { struct socket *tmp;