qemu-arm
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-arm] [PATCH] net: cadence_gem: check packet size in gem_reciev


From: Jason Wang
Subject: Re: [Qemu-arm] [PATCH] net: cadence_gem: check packet size in gem_recieve
Date: Mon, 18 Jan 2016 10:57:58 +0800
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1


On 01/15/2016 03:00 PM, P J P wrote:
> From: Prasad J Pandit <address@hidden>
>
> While receiving packets in 'gem_receive' routine, if Frame Check
> Sequence(FCS) is enabled, it copies the packet into a local
> buffer without checking its size. Add check to validate packet
> length against the buffer size to avoid buffer overflow.
>
> Reported-by: Ling Liu <address@hidden>
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
>  hw/net/cadence_gem.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
> index 3639fc1..c3a273b 100644
> --- a/hw/net/cadence_gem.c
> +++ b/hw/net/cadence_gem.c
> @@ -677,10 +677,14 @@ static ssize_t gem_receive(NetClientState *nc, const 
> uint8_t *buf, size_t size)
>      } else {
>          unsigned crc_val;
>  
> +        if (size > sizeof(rxbuf) - sizeof(crc_val)) {
> +            size = sizeof(rxbuf) - sizeof(crc_val);
> +        }
> +        bytes_to_copy = size;
> +
>          /* The application wants the FCS field, which QEMU does not provide.
>           * We must try and calculate one.
>           */
> -

Unnecessary whitespace change.

>          memcpy(rxbuf, buf, size);

We probably need more check, is there any guarantee that size <= 2048?
If not, need fix.

Thanks

>          memset(rxbuf + size, 0, sizeof(rxbuf) - size);
>          rxbuf_ptr = rxbuf;




reply via email to

[Prev in Thread] Current Thread [Next in Thread]