qemu-slirp: CVE-2014-3640

Fixes a NULL pointer deref in sosendto()

References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>

2 files changed, 47 insertions, 1 deletions

diff --git a/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch b/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch
new file mode 100644
index 0000000000..e45644f08c
--- /dev/null
+++ b/meta/recipes-devtools/qemu/files/slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch
@@ -0,0 +1,45 @@
+From 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a Mon Sep 17 00:00:00 2001
+From: Petr Matousek <pmatouse@redhat.com>
+Date: Thu, 18 Sep 2014 08:35:37 +0200
+Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of
+ uninitialized socket
+
+When guest sends udp packet with source port and source addr 0,
+uninitialized socket is picked up when looking for matching and already
+created udp sockets, and later passed to sosendto() where NULL pointer
+dereference is hit during so->slirp->vnetwork_mask.s_addr access.
+
+Fix this by checking that the socket is not just a socket stub.
+
+This is CVE-2014-3640.
+Upstream-Status: Backport
+
+Signed-off-by: Petr Matousek <pmatouse@redhat.com>
+Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com>
+Reported-by: Stephane Duverger <stephane.duverger@eads.net>
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
+Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ slirp/udp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/slirp/udp.c b/slirp/udp.c
+index 8cc6cb6..f77e00f 100644
+--- a/slirp/udp.c
++++ b/slirp/udp.c
+@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen)
+         * Locate pcb for datagram.
+         */
+        so = slirp->udp_last_so;
+-       if (so->so_lport != uh->uh_sport ||
++       if (so == &slirp->udb || so->so_lport != uh->uh_sport ||
+            so->so_laddr.s_addr != ip->ip_src.s_addr) {
+                struct socket *tmp;
+ 
+-- 
+1.9.1
+
diff --git a/meta/recipes-devtools/qemu/qemu_1.7.2.bb b/meta/recipes-devtools/qemu/qemu_1.7.2.bb
index e2e0c86a06..60a7937219 100644
--- a/meta/recipes-devtools/qemu/qemu_1.7.2.bb
+++ b/meta/recipes-devtools/qemu/qemu_1.7.2.bb
@@ -6,7 +6,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=441c28d2cf86e15a37fa47e15a72fbac \
 SRC_URI += "file://fxrstorssefix.patch \
             file://qemu-enlarge-env-entry-size.patch \
             file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \
-            file://ide-CVE-2014-2894.patch"
+            file://ide-CVE-2014-2894.patch \
+            file://slirp-udp-NULL-pointer-dereference-CVE-2014-3640.patch"
 
 SRC_URI_prepend = "http://wiki.qemu.org/download/qemu-${PV}.tar.bz2"
 SRC_URI[md5sum] = "a52e0acd37b0c9b06228fe98da0b1b43"