From 67f643e57e328b8e5485ae839a52aba39b051640 Mon Sep 17 00:00:00 2001
From: Jose R Ziviani <jose.ziviani@suse.com>
Date: Tue, 6 Jul 2021 17:11:04 -0600
Subject: [PATCH] libslirp: bootp: limit vendor-specific area to input packet
 memory buffer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Git-commit: f13cad45
References: bsc#1187364, CVE-2021-3592

sizeof(bootp_t) currently holds DHCP_OPT_LEN. Remove this optional field
from the structure, to help with the following patch checking for
minimal header size. Modify the bootp_reply() function to take the
buffer boundaries and avoiding potential buffer overflow.

Related to CVE-2021-3592.

https://gitlab.freedesktop.org/slirp/libslirp/-/issues/44

Signed-off-by: ￼Marc-André Lureau <marcandre.lureau@redhat.com>
[JRZ: backported from libslirp]
Signed-off-by: Jose R Ziviani <jose.ziviani@suse.com>
---
 slirp/bootp.c | 21 ++++++++++++---------
 slirp/bootp.h |  2 +-
 slirp/mbuf.c  |  5 +++++
 slirp/mbuf.h  |  1 +
 4 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/slirp/bootp.c b/slirp/bootp.c
index 911ec712c5..3b14960ad2 100644
--- a/slirp/bootp.c
+++ b/slirp/bootp.c
@@ -91,21 +91,21 @@ static BOOTPClient *find_addr(Slirp *slirp, struct in_addr *paddr,
     return bc;
 }
 
-static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type,
+static void dhcp_decode(const struct bootp_t *bp,
+                        const uint8_t *bp_end, int *pmsg_type,
                         const struct in_addr **preq_addr)
 {
-    const uint8_t *p, *p_end;
+    const uint8_t *p;
     int len, tag;
 
     *pmsg_type = 0;
     *preq_addr = NULL;
 
     p = bp->bp_vend;
-    p_end = p + DHCP_OPT_LEN;
     if (memcmp(p, rfc1533_cookie, 4) != 0)
         return;
     p += 4;
-    while (p < p_end) {
+    while (p < bp_end) {
         tag = p[0];
         if (tag == RFC1533_PAD) {
             p++;
@@ -113,7 +113,7 @@ static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type,
             break;
         } else {
             p++;
-            if (p >= p_end)
+            if (p >= bp_end)
                 break;
             len = *p++;
             dprintf("dhcp: tag=%d len=%d\n", tag, len);
@@ -138,7 +138,9 @@ static void dhcp_decode(const struct bootp_t *bp, int *pmsg_type,
     }
 }
 
-static void bootp_reply(Slirp *slirp, const struct bootp_t *bp)
+static void bootp_reply(Slirp *slirp,
+                        const struct bootp_t *bp,
+                        const uint8_t *bp_end)
 {
     BOOTPClient *bc = NULL;
     struct mbuf *m;
@@ -149,7 +151,7 @@ static void bootp_reply(Slirp *slirp, const struct bootp_t *bp)
     uint8_t *q;
 
     /* extract exact DHCP msg type */
-    dhcp_decode(bp, &dhcp_msg_type, &preq_addr);
+    dhcp_decode(bp, bp_end, &dhcp_msg_type, &preq_addr);
     dprintf("bootp packet op=%d msgtype=%d", bp->bp_op, dhcp_msg_type);
     if (preq_addr)
         dprintf(" req_addr=%08x\n", ntohl(preq_addr->s_addr));
@@ -170,9 +172,10 @@ static void bootp_reply(Slirp *slirp, const struct bootp_t *bp)
         return;
     }
     m->m_data += IF_MAXLINKHDR;
+    m_inc(m, sizeof(struct bootp_t) + DHCP_OPT_LEN);
     rbp = (struct bootp_t *)m->m_data;
     m->m_data += sizeof(struct udpiphdr);
-    memset(rbp, 0, sizeof(struct bootp_t));
+    memset(rbp, 0, sizeof(struct bootp_t) + DHCP_OPT_LEN);
 
     if (dhcp_msg_type == DHCPDISCOVER) {
         if (preq_addr) {
@@ -307,6 +310,6 @@ void bootp_input(struct mbuf *m)
     struct bootp_t *bp = mtod(m, struct bootp_t *);
 
     if (bp->bp_op == BOOTP_REQUEST) {
-        bootp_reply(m->slirp, bp);
+        bootp_reply(m->slirp, bp, m_end(m));
     }
 }
diff --git a/slirp/bootp.h b/slirp/bootp.h
index 30c30ab863..5aa1f93c8d 100644
--- a/slirp/bootp.h
+++ b/slirp/bootp.h
@@ -109,7 +109,7 @@ struct bootp_t {
     uint8_t bp_hwaddr[16];
     uint8_t bp_sname[64];
     uint8_t bp_file[128];
-    uint8_t bp_vend[DHCP_OPT_LEN];
+    uint8_t bp_vend[];
 };
 
 typedef struct {
diff --git a/slirp/mbuf.c b/slirp/mbuf.c
index 910e76db14..4e17b9f40d 100644
--- a/slirp/mbuf.c
+++ b/slirp/mbuf.c
@@ -227,3 +227,8 @@ void *mtod_check(struct mbuf *m, size_t len)
 
     return NULL;
 }
+
+void *m_end(struct mbuf *m)
+{
+    return m->m_data + m->m_len;
+}
diff --git a/slirp/mbuf.h b/slirp/mbuf.h
index e96b10b48d..3357d78124 100644
--- a/slirp/mbuf.h
+++ b/slirp/mbuf.h
@@ -124,5 +124,6 @@ void m_adj(struct mbuf *, int);
 int m_copy(struct mbuf *, struct mbuf *, int, int);
 struct mbuf * dtom(Slirp *, void *);
 void *mtod_check(struct mbuf *, size_t len);
+void *m_end(struct mbuf *);
 
 #endif
