Changeset 85146 in vbox for trunk/include/VBox/vmm

Timestamp:

Jul 9, 2020 10:20:38 AM (5 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

139093

Message:

Dev/E1000,PDM: (bugref:9764) disable UFO, UDP header checks, zero MSS handling.

File:

• trunk/include/VBox/vmm/pdmnetinline.h (modified) (1 diff)

trunk/include/VBox/vmm/pdmnetinline.h

@@ -542 +542 @@
         case PDMNETWORKGSOTYPE_IPV4_UDP:
             if (iSeg == 0)
+            {
+                if (pGso->offHdr2 + sizeof(RTNETUDP::uh_ulen) > cbFrame)
+                    return 0; /* Incomplete UDP header! */
+                /* uh_ulen cannot exceed cbFrame - pGso->offHdr2 (offset of UDP header) */
+                if ((unsigned)(pGso->offHdr2 + RT_BE2H_U16(((PCRTNETUDP)&pbFrame[pGso->offHdr2])->uh_ulen)) > cbFrame)
+                    if (cbFrame > UINT16_MAX)
+                        ((PRTNETUDP)&pbFrame[pGso->offHdr2])->uh_ulen = 0xFFFF;
+                    else
+                        ((PRTNETUDP)&pbFrame[pGso->offHdr2])->uh_ulen = RT_H2BE_U16((uint16_t)(cbFrame - pGso->offHdr2));
+                Assert((unsigned)(pGso->offHdr2 + ((PCRTNETUDP)&pbFrame[pGso->offHdr2])->uh_ulen) <= cbFrame);
                 pdmNetGsoUpdateUdpHdrUfo(RTNetIPv4PseudoChecksum((PRTNETIPV4)&pbFrame[pGso->offHdr1]),
                                          pbSegHdrs, pbFrame, pGso->offHdr2);
+            }
             pdmNetGsoUpdateIPv4HdrUfo(pbSegHdrs, pGso->offHdr1, cbSegPayload, iSeg * pGso->cbMaxSeg,
                                       cbSegHdrs, iSeg + 1 == cSegs);