Changeset 90196 in vbox for trunk/include

Timestamp:

Jul 14, 2021 8:00:10 PM (4 years ago)

Author:

vboxsync

Message:

Network: (bugref:10024) GSO UDP header fixes.

File:

• trunk/include/VBox/vmm/pdmnetinline.h (modified) (3 diffs)

trunk/include/VBox/vmm/pdmnetinline.h

@@ -144 +144 @@
     { /* likely */ } else return false;
     if (RT_LIKELY( cbFrame - pGso->cbHdrsTotal >= pGso->cbMaxSeg ))
+    { /* likely */ } else return false;
+
+    /* Make sure the segment size is enough to fit a UDP header. */
+    if (RT_LIKELY(enmType != PDMNETWORKGSOTYPE_IPV4_UDP || pGso->cbMaxSeg >= RTNETUDP_MIN_LEN))
     { /* likely */ } else return false;
 
@@ -450 +454 @@
         case PDMNETWORKGSOTYPE_IPV4_UDP:
             if (iSeg == 0)
+            {
+                /* uh_ulen shall not exceed cbFrame - pGso->offHdr2 (offset of UDP header) */
+                PRTNETUDP pUdpHdr = (PRTNETUDP)&pbFrame[pGso->offHdr2];
+                Assert(pGso->offHdr2 + RT_UOFFSET_AFTER(RTNETUDP, uh_ulen) <= cbFrame);
+                if ((unsigned)(pGso->offHdr2 + RT_BE2H_U16(pUdpHdr->uh_ulen)) > cbFrame)
+                {
+                    size_t cbUdp = cbFrame - pGso->offHdr2;
+                    if (cbUdp >= UINT16_MAX)
+                        pUdpHdr->uh_ulen = UINT16_MAX;
+                    else
+                        pUdpHdr->uh_ulen = RT_H2BE_U16((uint16_t)cbUdp);
+                }
+                /* uh_ulen shall be at least the size of UDP header */
+                if (RT_BE2H_U16(pUdpHdr->uh_ulen) < sizeof(RTNETUDP))
+                    pUdpHdr->uh_ulen = RT_H2BE_U16(sizeof(RTNETUDP));
                 pdmNetGsoUpdateUdpHdrUfo(RTNetIPv4PseudoChecksum((PRTNETIPV4)&pbFrame[pGso->offHdr1]),
                                          pbSegHdrs, pbFrame, pGso->offHdr2);
+            }
             pdmNetGsoUpdateIPv4HdrUfo(pbSegHdrs, pGso->offHdr1, cbSegPayload, iSeg * pGso->cbMaxSeg,
                                       pdmNetSegHdrLen(pGso, iSeg), iSeg + 1 == cSegs);
@@ -560 +580 @@
                         pUdpHdr->uh_ulen = RT_H2BE_U16((uint16_t)cbUdp);
                 }
+                /* uh_ulen shall be at least the size of UDP header */
+                if (RT_BE2H_U16(pUdpHdr->uh_ulen) < sizeof(RTNETUDP))
+                    pUdpHdr->uh_ulen = RT_H2BE_U16(sizeof(RTNETUDP));
                 pdmNetGsoUpdateUdpHdrUfo(RTNetIPv4PseudoChecksum((PRTNETIPV4)&pbFrame[pGso->offHdr1]),
                                          pbSegHdrs, pbFrame, pGso->offHdr2);