diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-02-24 11:41:33 +0530 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2016-03-17 16:34:56 -0500 |
| commit | fe90bdc25bcf9954ee286cd51de94776a17d04f6 (patch) | |
| tree | ed349e220bbf0c177c8f9756028f66f7ede6b133 | |
| parent | aaa52713278e3002e364edee264ce2df6b2bde4e (diff) | |
| download | qemu-fe90bdc25bcf9954ee286cd51de94776a17d04f6.zip qemu-fe90bdc25bcf9954ee286cd51de94776a17d04f6.tar.gz qemu-fe90bdc25bcf9954ee286cd51de94776a17d04f6.tar.bz2 | |
net: ne2000: check ring buffer control registers
Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
bytes to process network packets. Registers PSTART & PSTOP
define ring buffer size & location. Setting these registers
to invalid values could lead to infinite loop or OOB r/w
access issues. Add check to avoid it.
Reported-by: Yang Hongke <yanghongke@huawei.com>
Tested-by: Yang Hongke <yanghongke@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 415ab35a441eca767d033a2702223e785b9d5190)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/net/ne2000.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c index 010f9ef..84a7263 100644 --- a/hw/net/ne2000.c +++ b/hw/net/ne2000.c @@ -154,6 +154,10 @@ static int ne2000_buffer_full(NE2000State *s) { int avail, index, boundary; + if (s->stop <= s->start) { + return 1; + } + index = s->curpag << 8; boundary = s->boundary << 8; if (index < boundary) |