diff options
| author | pbrook <pbrook@c046a42c-6fe2-441c-8c8c-71466251a162> | 2006-02-04 22:15:28 +0000 |
|---|---|---|
| committer | pbrook <pbrook@c046a42c-6fe2-441c-8c8c-71466251a162> | 2006-02-04 22:15:28 +0000 |
| commit | d861b05ea30e6ac177de9b679da96194ebe21afc (patch) | |
| tree | 6bb3605e24633c0e64c9b7396873bbe28fe93be1 /hw/smc91c111.c | |
| parent | 191abaa2f0aca0c6ebca06f3e985da02ac950d14 (diff) | |
| download | qemu-d861b05ea30e6ac177de9b679da96194ebe21afc.zip qemu-d861b05ea30e6ac177de9b679da96194ebe21afc.tar.gz qemu-d861b05ea30e6ac177de9b679da96194ebe21afc.tar.bz2 | |
Avoid buffer overflow when sending slirp packets.
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1744 c046a42c-6fe2-441c-8c8c-71466251a162
Diffstat (limited to 'hw/smc91c111.c')
| -rw-r--r-- | hw/smc91c111.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/hw/smc91c111.c b/hw/smc91c111.c index 375debd..214e92e 100644 --- a/hw/smc91c111.c +++ b/hw/smc91c111.c @@ -593,6 +593,17 @@ static uint32_t smc91c111_readl(void *opaque, target_phys_addr_t offset) return val; } +static int smc91c111_can_receive(void *opaque) +{ + smc91c111_state *s = (smc91c111_state *)opaque; + + if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) + return 1; + if (s->allocated == (1 << NUM_PACKETS) - 1) + return 0; + return 1; +} + static void smc91c111_receive(void *opaque, const uint8_t *buf, int size) { smc91c111_state *s = (smc91c111_state *)opaque; @@ -697,6 +708,7 @@ void smc91c111_init(NICInfo *nd, uint32_t base, void *pic, int irq) smc91c111_reset(s); - s->vc = qemu_new_vlan_client(nd->vlan, smc91c111_receive, s); + s->vc = qemu_new_vlan_client(nd->vlan, smc91c111_receive, + smc91c111_can_receive, s); /* ??? Save/restore. */ } |