[OE-core] [PATCH][krogoth] Qemu: net: CVE-2016-4001

[Sona Sarmadi]

buffer overflow in stellaris_enet emulator

Reference to upstream patch:
http://git.qemu.org/?p=qemu.git;a=patch;h=3a15cc0e1ee7168db0782133d2607a6bfa422d66

Reference:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4001

Signed-off-by: Sona Sarmadi <sona.sarmadi at enea.com>
---
 .../recipes-devtools/qemu/qemu/CVE-2016-4001.patch | 51 ++++++++++++++++++++++
 meta/recipes-devtools/qemu/qemu_2.5.0.bb           |  1 +
 2 files changed, 52 insertions(+)
 create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-4001.patch

diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-4001.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-4001.patch
new file mode 100644
index 0000000..cfec8b8
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2016-4001.patch
@@ -0,0 +1,51 @@
+From 3a15cc0e1ee7168db0782133d2607a6bfa422d66 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp at fedoraproject.org>
+Date: Fri, 8 Apr 2016 11:33:48 +0530
+Subject: [PATCH] net: stellaris_enet: check packet length against receive
+ buffer
+
+When receiving packets over Stellaris ethernet controller, it
+uses receive buffer of size 2048 bytes. In case the controller
+accepts large(MTU) packets, it could lead to memory corruption.
+Add check to avoid it.
+
+CVE: CVE-2016-4001
+Upstream-Status: Backport
+
+Reported-by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk at intel.com>
+Signed-off-by: Prasad J Pandit <pjp at fedoraproject.org>
+Message-id: 1460095428-22698-1-git-send-email-ppandit at redhat.com
+Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi at enea.com>
+---
+ hw/net/stellaris_enet.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
+index 84cf60b..6880894 100644
+--- a/hw/net/stellaris_enet.c
++++ b/hw/net/stellaris_enet.c
+@@ -236,8 +236,18 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si
+     n = s->next_packet + s->np;
+     if (n >= 31)
+         n -= 31;
+-    s->np++;
+ 
++    if (size >= sizeof(s->rx[n].data) - 6) {
++        /* If the packet won't fit into the
++         * emulated 2K RAM, this is reported
++         * as a FIFO overrun error.
++         */
++        s->ris |= SE_INT_FOV;
++        stellaris_enet_update(s);
++        return -1;
++    }
++
++    s->np++;
+     s->rx[n].len = size + 6;
+     p = s->rx[n].data;
+     *(p++) = (size + 6);
+-- 
+1.9.1
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.5.0.bb b/meta/recipes-devtools/qemu/qemu_2.5.0.bb
index b965f69..6823b62 100644
--- a/meta/recipes-devtools/qemu/qemu_2.5.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.5.0.bb
@@ -28,6 +28,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
             file://CVE-2016-5403.patch \
             file://CVE-2016-4441.patch \
             file://CVE-2016-4952.patch \
+            file://CVE-2016-4001.patch \
            "
 SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
 SRC_URI[md5sum] = "f469f2330bbe76e3e39db10e9ac4f8db"
-- 
1.9.1