[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL V2 03/17] net: cadence_gem: check packet size in gem_
From: |
Jason Wang |
Subject: |
[Qemu-devel] [PULL V2 03/17] net: cadence_gem: check packet size in gem_recieve |
Date: |
Thu, 4 Feb 2016 16:31:32 +0800 |
From: Prasad J Pandit <address@hidden>
While receiving packets in 'gem_receive' routine, if Frame Check
Sequence(FCS) is enabled, it copies the packet into a local
buffer without checking its size. Add check to validate packet
length against the buffer size to avoid buffer overflow.
Reported-by: Ling Liu <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
hw/net/cadence_gem.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index f9e4091..e513d9d 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -678,6 +678,10 @@ static ssize_t gem_receive(NetClientState *nc, const
uint8_t *buf, size_t size)
} else {
unsigned crc_val;
+ if (size > sizeof(rxbuf) - sizeof(crc_val)) {
+ size = sizeof(rxbuf) - sizeof(crc_val);
+ }
+ bytes_to_copy = size;
/* The application wants the FCS field, which QEMU does not provide.
* We must try and calculate one.
*/
--
2.5.0
- [Qemu-devel] [PULL V2 00/17] Net patches, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 01/17] net/slirp: Tell the users when they are using deprecated options, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 02/17] qemu-doc: Do not promote deprecated -smb and -redir options, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 05/17] slirp: goto bad in udp_input if sosendto fails, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 06/17] slirp: Generalizing and neutralizing ARP code, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 07/17] slirp: Adding address family switch for produced frames, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 03/17] net: cadence_gem: check packet size in gem_recieve,
Jason Wang <=
- [Qemu-devel] [PULL V2 04/17] cadence_gem: fix buffer overflow, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 08/17] slirp: Make Socket structure IPv6 compatible, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 09/17] slirp: Factorizing address translation, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 10/17] slirp: Factorizing and cleaning solookup(), Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 11/17] slirp: Add sockaddr_equal, make solookup family-agnostic, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 12/17] slirp: Make udp_attach IPv6 compatible, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 13/17] slirp: Adding family argument to tcp_fconnect(), Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 14/17] e1000: eliminate infinite loops on out-of-bounds transfer start, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 15/17] net: netmap: use nm_open() to open netmap ports, Jason Wang, 2016/02/04
- [Qemu-devel] [PULL V2 16/17] net: always walk through filters in reverse if traffic is egress, Jason Wang, 2016/02/04