[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read
From: |
arei.gonglei |
Subject: |
[Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read |
Date: |
Thu, 20 Nov 2014 13:57:13 +0800 |
From: Gonglei <address@hidden>
s->xmit_pos maybe assigned to a negative value (-1),
but in this branch variable s->xmit_pos as an index to
array s->buffer. Let's add a check for s->xmit_pos.
Signed-off-by: Gonglei <address@hidden>
---
hw/net/pcnet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index d344c15..2bb6417 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -1247,7 +1247,7 @@ static void pcnet_transmit(PCNetState *s)
s->xmit_pos = -1;
goto txdone;
}
- if (!GET_FIELD(tmd.status, TMDS, ENP)) {
+ if (!GET_FIELD(tmd.status, TMDS, ENP) && (s->xmit_pos >= 0)) {
int bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
s->phys_mem_read(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
s->buffer + s->xmit_pos, bcnt, CSR_BSWP(s));
--
1.7.12.4
[Qemu-devel] [PATCH 4/4] rtl8139: fix Pointer to local outside scope, arei.gonglei, 2014/11/20