diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-01-15 12:30:40 +0530 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2016-02-04 13:22:06 +0800 |
| commit | 244381ec19ce1412b474f41b5f30fe1da846451b (patch) | |
| tree | 5504876e9841404fb9f5ba5fc0863327e332c391 /hw | |
| parent | c8c6afa8867b43e6b2a0553a8eb6c880f27a8379 (diff) | |
| download | qemu-244381ec19ce1412b474f41b5f30fe1da846451b.zip qemu-244381ec19ce1412b474f41b5f30fe1da846451b.tar.gz qemu-244381ec19ce1412b474f41b5f30fe1da846451b.tar.bz2 | |
net: cadence_gem: check packet size in gem_recieve
While receiving packets in 'gem_receive' routine, if Frame Check
Sequence(FCS) is enabled, it copies the packet into a local
buffer without checking its size. Add check to validate packet
length against the buffer size to avoid buffer overflow.
Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/net/cadence_gem.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c index f9e4091..e513d9d 100644 --- a/hw/net/cadence_gem.c +++ b/hw/net/cadence_gem.c @@ -678,6 +678,10 @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size) } else { unsigned crc_val; + if (size > sizeof(rxbuf) - sizeof(crc_val)) { + size = sizeof(rxbuf) - sizeof(crc_val); + } + bytes_to_copy = size; /* The application wants the FCS field, which QEMU does not provide. * We must try and calculate one. */ |