Changeset 83597 in vbox for trunk/src/VBox/Devices/Network/slirp

Timestamp:

Apr 7, 2020 1:15:34 AM (5 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

136996

Message:

NAT: bugref:9694 - libalias NBT - IP header is verified, but UDP
header is not, so cross check UDP length against IP header.

File:

• trunk/src/VBox/Devices/Network/slirp/libalias/alias_nbt.c (modified) (2 diffs)

trunk/src/VBox/Devices/Network/slirp/libalias/alias_nbt.c

@@ -437 +437 @@
     pmax = (char *)uh + ntohs(uh->uh_ulen);
 
+    /* IP header has been verified, cross-check uh_ulen */
+    if (RT_UNLIKELY(pmax != (char *)pip + ntohs(pip->ip_len)))
+        return (-1);
+
     ndh = (NbtDataHeader *)udp_next(uh);
     if ((char *)(ndh + 1) > pmax)
@@ -886 +890 @@
     pmax = (char *)uh + ntohs(uh->uh_ulen);
 
+    /* IP header has been verified, cross-check uh_ulen */
+    if (RT_UNLIKELY(pmax != (char *)pip + ntohs(pip->ip_len)))
+        return (-1);
+
     if ((char *)(nsh + 1) > pmax)
         return (-1);