Changeset 87126 in vbox for trunk/src

Timestamp:

Dec 25, 2020 2:51:44 AM (4 years ago)

Author:

vboxsync

Message:

slirp: arp_input - more checks on incoming packets.

Location:

trunk/src/VBox/Devices/Network/slirp

Files:

• slirp.c (modified) (3 diffs)
• slirp.h (modified) (1 diff)

trunk/src/VBox/Devices/Network/slirp/slirp.c

@@ -1254 +1254 @@
 {
     unsigned short  ar_hrd;             /* format of hardware address   */
+#define ARPHRD_ETHER    1               /* ethernet hardware format     */
     unsigned short  ar_pro;             /* format of protocol address   */
     unsigned char   ar_hln;             /* length of hardware address   */
     unsigned char   ar_pln;             /* length of protocol address   */
     unsigned short  ar_op;              /* ARP opcode (command)         */
+#define ARPOP_REQUEST   1               /* ARP request                  */
+#define ARPOP_REPLY     2               /* ARP reply                    */
 
     /*
@@ -1323 +1326 @@
     struct ethhdr *pEtherHeader;
     struct arphdr *pARPHeader;
+    int ar_op;
     uint32_t ip4TargetAddress;
 
-    int ar_op;
+    /* drivers never return runt packets, so this should never happen */
+    if (RT_UNLIKELY((size_t)m->m_len
+                    < sizeof(struct ethhdr) + sizeof(struct arphdr)))
+        goto done;
+
     pEtherHeader = mtod(m, struct ethhdr *);
     pARPHeader = (struct arphdr *)&pEtherHeader[1];
+
+    if (RT_UNLIKELY(   pARPHeader->ar_hrd != RT_H2N_U16_C(ARPHRD_ETHER)
+                    || pARPHeader->ar_pro != RT_H2N_U16_C(ETH_P_IP)
+                    || pARPHeader->ar_hln != ETH_ALEN
+                    || pARPHeader->ar_pln != sizeof(RTNETADDRIPV4)))
+        goto done;
 
     ar_op = RT_N2H_U16(pARPHeader->ar_op);
@@ -1365 +1379 @@
     }
 
+  done:
     m_freem(pData, m);
 }

trunk/src/VBox/Devices/Network/slirp/slirp.h

@@ -390 +390 @@
 # define ETH_HLEN        14
 
-# define ARPOP_REQUEST   1               /* ARP request                  */
-# define ARPOP_REPLY     2               /* ARP reply                    */
-
 struct ethhdr
 {