[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] net: mipsnet: check packet length against buffe
From: |
Jason Wang |
Subject: |
Re: [Qemu-devel] [PATCH] net: mipsnet: check packet length against buffer |
Date: |
Tue, 26 Apr 2016 15:16:55 +0800 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 |
On 04/07/2016 06:26 PM, P J P wrote:
> From: Prasad J Pandit <address@hidden>
>
> When receiving packets over MIPSnet network device, it uses
> receive buffer of size 1514 bytes. In case the controller
> accepts large(MTU) packets, it could lead to memory corruption.
> Add check to avoid it.
>
> Reported by: Oleksandr Bazhaniuk <address@hidden>
>
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
> hw/net/mipsnet.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
> index f261011..e134b31 100644
> --- a/hw/net/mipsnet.c
> +++ b/hw/net/mipsnet.c
> @@ -82,6 +82,9 @@ static ssize_t mipsnet_receive(NetClientState *nc, const
> uint8_t *buf, size_t si
> if (!mipsnet_can_receive(nc))
> return 0;
>
> + if (size >= sizeof(s->rx_buffer)) {
> + return 0;
> + }
> s->busy = 1;
>
> /* Just accept everything. */
Apply to net-next.
Thanks