Peter Maydell 09b94ac0f2 slirp: Correct size check in m_inc() ... The data in an mbuf buffer is not necessarily at the start of the allocated buffer. (For instance m_adj() allows data to be trimmed from the start by just advancing the pointer and reducing the length.) This means that the allocated buffer size (m->m_size) and the amount of space from the m_data pointer to the end of the buffer (M_ROOM(m)) are not necessarily the same. Commit 864036e251 tried to change the m_inc() function from taking the new allocated-buffer-size to taking the new room-size, but forgot to change the initial "do we already have enough space" check. This meant that if we were trying to extend a buffer which had a leading gap between the buffer start and the data, we might incorrectly decide it didn't need to be extended, and then overrun the end of the buffer, causing memory corruption and an eventual crash. Change the "already big enough?" condition from checking the argument against m->m_size to checking against M_ROOM(). This only makes a difference for the callsite in m_cat(); the other three callsites all start with a freshly allocated mbuf from m_get(), which will have m->m_size == M_ROOM(m). Fixes: 864036e251 Fixes: https://bugs.launchpad.net/qemu/+bug/1785670 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-id: 20180807114501.12370-1-peter.maydell@linaro.org Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>		2018-08-07 14:13:22 +01:00
..
arp_table.c	slirp/debug: Print IP addresses in human readable form	2018-05-31 21:19:24 +02:00
bootp.c	slirp: Add domainname option to slirp's DHCP server	2018-05-31 21:19:08 +02:00
bootp.h
cksum.c
COPYRIGHT
debug.h
dhcpv6.c
dhcpv6.h	slirp: add in6_dhcp_multicast()	2018-01-14 18:16:13 +01:00
dnssearch.c
if.c
if.h
ip6_icmp.c	slirp: avoid IN6_IS_ADDR_UNSPECIFIED(), rather use in6_zero()	2018-01-14 18:16:13 +01:00
ip6_icmp.h
ip6_input.c
ip6_output.c
ip6.h
ip_icmp.c
ip_icmp.h
ip_input.c
ip_output.c
ip.h	slirp: removed unused code	2018-01-14 18:16:13 +01:00
libslirp.h	slirp: Add domainname option to slirp's DHCP server	2018-05-31 21:19:08 +02:00
main.h
Makefile.objs
mbuf.c	slirp: Correct size check in m_inc()	2018-08-07 14:13:22 +01:00
mbuf.h	slirp: correct size computation while concatenating mbuf	2018-06-08 09:08:30 +03:00
misc.c
misc.h
ncsi-pkt.h
ncsi.c	slirp/ncsi: add checksum support	2018-05-31 21:19:24 +02:00
ndp_table.c	slirp: avoid IN6_IS_ADDR_UNSPECIFIED(), rather use in6_zero()	2018-01-14 18:16:13 +01:00
sbuf.c
sbuf.h
slirp_config.h
slirp.c	slirp: Send window updates to guest after window was closed	2018-05-31 21:19:24 +02:00
slirp.h	slirp: Add domainname option to slirp's DHCP server	2018-05-31 21:19:08 +02:00
socket.c	slirp: Fix spurious error report when sending directly	2018-06-01 16:45:49 +02:00
socket.h
tcp_input.c
tcp_output.c
tcp_subr.c	slirp: disable Nagle in outgoing connections	2018-05-31 21:19:24 +02:00
tcp_timer.c
tcp_timer.h
tcp_var.h
tcp.h
tcpip.h
tftp.c
tftp.h
udp6.c	slirp: add in6_dhcp_multicast()	2018-01-14 18:16:13 +01:00
udp.c	slirp/debug: Print IP addresses in human readable form	2018-05-20 08:25:23 +03:00
udp.h