File 0110-slirp-ensure-there-is-enough-space-.patch of Package qemu.18974

From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Fri, 3 May 2019 13:32:04 +0200
Subject: slirp: ensure there is enough space in mbuf to null-terminate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prevents from buffer overflows.
Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1664205

Cc: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
[BFR: In support of BSC#1123156]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 slirp/tcp_subr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
index 86d8e6fe87c2050a917f508cc662..02e4451f6c6226285f6460ddafc5 100644
--- a/slirp/tcp_subr.c
+++ b/slirp/tcp_subr.c
@@ -643,6 +643,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 			memcpy(so_rcv->sb_wptr, m->m_data, m->m_len);
 			so_rcv->sb_wptr += m->m_len;
 			so_rcv->sb_rptr += m->m_len;
+			m_inc(m, m->m_len + 1);
 			m->m_data[m->m_len] = 0; /* NULL terminate */
 			if (strchr(m->m_data, '\r') || strchr(m->m_data, '\n')) {
 				if (sscanf(so_rcv->sb_data, "%u%*[ ,]%u", &n1, &n2) == 2) {
@@ -676,6 +677,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 		}
 
         case EMU_FTP: /* ftp */
+		m_inc(m, m->m_len + 1);
                 *(m->m_data+m->m_len) = 0; /* NUL terminate for strstr */
 		if ((bptr = (char *)strstr(m->m_data, "ORT")) != NULL) {
 			/*
@@ -773,6 +775,7 @@ tcp_emu(struct socket *so, struct mbuf *m)
 		/*
 		 * Need to emulate DCC CHAT, DCC SEND and DCC MOVE
 		 */
+		m_inc(m, m->m_len + 1);
 		*(m->m_data+m->m_len) = 0; /* NULL terminate the string for strstr */
 		if ((bptr = (char *)strstr(m->m_data, "DCC")) == NULL)
 			 return 1;