Changeset 47506 in vbox

Timestamp:

Aug 1, 2013 12:08:51 PM (11 years ago)

Author:

vboxsync

Message:

NAT: Drop oversized frames coming from guest (#6821)

Location:

trunk/src/VBox/Devices/Network

Files:

• DrvNAT.cpp (modified) (3 diffs)
• slirp/ip_icmp.c (modified) (3 diffs)

trunk/src/VBox/Devices/Network/DrvNAT.cpp

@@ -60 +60 @@
 *   Defined Constants And Macros                                               *
 *******************************************************************************/
+
+#define DRVNAT_MAXFRAMESIZE (16 * 1024)
 
 /**
@@ -466 +468 @@
     if (!pGso)
     {
+        /*
+         * Drop the frame if it is too big.
+         */
+        if (cbMin >= DRVNAT_MAXFRAMESIZE)
+        {
+            Log(("drvNATNetowrkUp_AllocBuf: drops over-sized frame (%u bytes), returns VERR_INVALID_PARAMETER\n",
+                 cbMin));
+            return VERR_INVALID_PARAMETER;
+        }
+
         pSgBuf->pvUser      = NULL;
         pSgBuf->pvAllocator = slirp_ext_m_get(pThis->pNATState, cbMin,
@@ -477 +489 @@
     else
     {
+        /*
+         * Drop the frame if its segment is too big.
+         */
+        if (pGso->cbHdrsTotal + pGso->cbMaxSeg >= DRVNAT_MAXFRAMESIZE)
+        {
+            Log(("drvNATNetowrkUp_AllocBuf: drops over-sized frame (%u bytes), returns VERR_INVALID_PARAMETER\n",
+                 pGso->cbHdrsTotal + pGso->cbMaxSeg));
+            return VERR_INVALID_PARAMETER;
+        }
+
         pSgBuf->pvUser      = RTMemDup(pGso, sizeof(*pGso));
         pSgBuf->pvAllocator = NULL;

trunk/src/VBox/Devices/Network/slirp/ip_icmp.c

@@ -613 +613 @@
     register struct icmp *icp;
     register struct mbuf *m;
+    int new_ip_size = 0;
     int new_m_size = 0;
     int size = 0;
@@ -653 +654 @@
     }
 
-    new_m_size = sizeof(struct ip) + ICMP_MINLEN + msrc->m_len + ICMP_MAXDATALEN;
+    new_ip_size = sizeof(struct ip) + ICMP_MINLEN + ICMP_MAXDATALEN;
+    new_m_size = if_maxlinkhdr + new_ip_size;
     if (new_m_size < MSIZE)
         size = MCLBYTES;
@@ -671 +673 @@
     m->m_pkthdr.header = mtod(m, void *);
 
-    memcpy(m->m_data, msrc->m_data, msrc->m_len);
-    m->m_len = msrc->m_len;                /* copy msrc to m */
+    m->m_len = msrc->m_len < new_ip_size ? msrc->m_len : new_ip_size;
+    memcpy(m->m_data, msrc->m_data, m->m_len);   /* copy msrc to m */
 
     /* make the header of the reply packet */