From 83935b86f9d0ce3e56b3449752efb232e3592501 Mon Sep 17 00:00:00 2001 From: Fam Zheng Date: Tue, 25 Mar 2014 11:45:53 +0100 Subject: [PATCH 35/48] curl: check data size before memcpy to local buffer. (CVE-2014-0144) RH-Author: Kevin Wolf Message-id: <1395744364-16049-35-git-send-email-kwolf@redhat.com> Patchwork-id: n/a O-Subject: [EMBARGOED RHEL-6.6/6.5.z qemu-kvm PATCH v2 34/45] curl: check data size before memcpy to local buffer. (CVE-2014-0144) Bugzilla: 1079453 RH-Acked-by: Max Reitz RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Laszlo Ersek Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1079453 Upstream status: Embargoed curl_read_cb is callback function for libcurl when data arrives. The data size passed in here is not guaranteed to be within the range of request we submitted, so we may overflow the guest IO buffer. Check the real size we have before memcpy to buffer to avoid overflow. Signed-off-by: Fam Zheng Reviewed-by: Stefan Hajnoczi Signed-off-by: Kevin Wolf --- block/curl.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/block/curl.c b/block/curl.c index bf636da..831850b 100644 --- a/block/curl.c +++ b/block/curl.c @@ -124,6 +124,11 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque) if (!s || !s->orig_buf) goto read_end; + if (s->buf_off >= s->buf_len) { + /* buffer full, read nothing */ + return 0; + } + realsize = MIN(realsize, s->buf_len - s->buf_off); memcpy(s->orig_buf + s->buf_off, ptr, realsize); s->buf_off += realsize; -- 1.7.1