Re: [Qemu-devel] [PATCH v2] net: stellaris_enet: check packet length against receive buffer

[Peter Maydell]

On 7 April 2016 at 13:35, P J P <address@hidden> wrote:
> From: Prasad J Pandit <address@hidden>
>
> When receiving packets over Stellaris ethernet controller, it
> uses receive buffer of size 2048 bytes. In case the controller
> accepts large(MTU) packets, it could lead to memory corruption.
> Add check to avoid it.
>
> Reported by: Oleksandr Bazhaniuk <address@hidden>
>
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
>  hw/net/stellaris_enet.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> Update per review:
>   -> https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01142.html
>
> diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
> index 21a4773..eddbe60 100644
> --- a/hw/net/stellaris_enet.c
> +++ b/hw/net/stellaris_enet.c
> @@ -235,8 +235,16 @@ static ssize_t stellaris_enet_receive(NetClientState 
> *nc, const uint8_t *buf, si
>      n = s->next_packet + s->np;
>      if (n >= 31)
>          n -= 31;
> +    if (size >= sizeof(s->rx[n].data) - 6) {
> +        /* If the packet won't fit into the
> +         * emulated 2K RAM, this is reported
> +         * as a FIFO overrun error.
> +         */
> +        s->ris |= SE_INT_FOV;
> +        stellaris_enet_update(s);
> +        return -1;
> +    }

I think you could reasonably put a blank line before and after
the if() {} you've added here.

>      s->np++;
> -

Stray whitespace change.

>      s->rx[n].len = size + 6;
>      p = s->rx[n].data;
>      *(p++) = (size + 6);
> --
> 2.5.5
>

Otherwise
Reviewed-by: Peter Maydell <address@hidden>

thanks
-- PMM