diff options
| author | Stephen Longfield <slongfield@google.com> | 2023-02-07 09:02:04 +0100 |
|---|---|---|
| committer | Cédric Le Goater <clg@kaod.org> | 2023-02-07 09:02:04 +0100 |
| commit | 036e98e5c2b4e25c8d6ccbddb85c7ab05a753f6a (patch) | |
| tree | efc020727039a0c6fa10106d401d929b8b08e37f | |
| parent | 479365979bdc2fc4f8d2375085c980fe3f520c39 (diff) | |
| download | qemu-036e98e5c2b4e25c8d6ccbddb85c7ab05a753f6a.zip qemu-036e98e5c2b4e25c8d6ccbddb85c7ab05a753f6a.tar.gz qemu-036e98e5c2b4e25c8d6ccbddb85c7ab05a753f6a.tar.bz2 | |
hw/net: Fix read of uninitialized memory in ftgmac100
With the `size += 4` before the call to `crc32`, the CRC calculation
would overrun the buffer. Size is used in the while loop starting on
line 1009 to determine how much data to write back, with the last
four bytes coming from `crc_ptr`, so do need to increase it, but should
do this after the computation.
I'm unsure why this use of uninitialized memory in the CRC doesn't
result in CRC errors, but it seems clear to me that it should not be
included in the calculation.
Signed-off-by: Stephen Longfield <slongfield@google.com>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20221220221437.3303721-1-slongfield@google.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
| -rw-r--r-- | hw/net/ftgmac100.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c index 83ef0a7..d3bf14b 100644 --- a/hw/net/ftgmac100.c +++ b/hw/net/ftgmac100.c @@ -980,9 +980,9 @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf, return size; } - /* 4 bytes for the CRC. */ - size += 4; crc = cpu_to_be32(crc32(~0, buf, size)); + /* Increase size by 4, loop below reads the last 4 bytes from crc_ptr. */ + size += 4; crc_ptr = (uint8_t *) &crc; /* Huge frames are truncated. */ |