[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] Stack smash in hw/eepro100.c
From: |
Emil Mikulic |
Subject: |
[Qemu-devel] Stack smash in hw/eepro100.c |
Date: |
Sat, 6 Sep 2008 01:40:13 +1000 |
User-agent: |
Mutt/1.5.18 (2008-05-17) |
Hi there,
I've got qemu and kvm crashing when I try to scp data from a VM with
-net nic,model=i82551. I believe the problem is here:
(hw/eepro100.c, SVN r4892)
658 static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
[...]
723 uint8_t buf[MAX_ETH_FRAME_SIZE + 4];
[...]
745 /* Extended TCB. */
746 assert(tcb_bytes == 0);
747 for (; tbd_count < 2; tbd_count++) {
748 uint32_t tx_buffer_address = ldl_phys(tbd_address);
749 uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
750 uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
751 tbd_address += 8;
752 logout
753 ("TBD (extended mode): buffer address 0x%08x[...]
754 tx_buffer_address, tx_buffer_size);
755 cpu_physical_memory_read(tx_buffer_address, &buf[size],
756 tx_buffer_size);
^ KABOOM
What happens is:
- tbd_count=0, size=0, tx_buffer_size=130
- tbd_count=1, size=130, tx_buffer_size=1448
130 + 1448 = 1578
sizeof(buf) = 1518
I believe cpu_physical_memory_read() is writing past the end of buf[]
and clobbering the call stack.
I don't know what the right solution is here.
For testing, I made buf[] larger and scp completed without incident
instead of crashing qemu after a few KB. e.g.:
- uint8_t buf[MAX_ETH_FRAME_SIZE + 4];
+ uint8_t buf[MAX_ETH_FRAME_SIZE + 1000];
--Emil
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-devel] Stack smash in hw/eepro100.c,
Emil Mikulic <=