aboutsummaryrefslogtreecommitdiff
path: root/tests
diff options
context:
space:
mode:
authorStephen Longfield <slongfield@google.com>2023-02-07 09:02:04 +0100
committerCédric Le Goater <clg@kaod.org>2023-02-07 09:02:04 +0100
commit036e98e5c2b4e25c8d6ccbddb85c7ab05a753f6a (patch)
treeefc020727039a0c6fa10106d401d929b8b08e37f /tests
parent479365979bdc2fc4f8d2375085c980fe3f520c39 (diff)
downloadqemu-036e98e5c2b4e25c8d6ccbddb85c7ab05a753f6a.zip
qemu-036e98e5c2b4e25c8d6ccbddb85c7ab05a753f6a.tar.gz
qemu-036e98e5c2b4e25c8d6ccbddb85c7ab05a753f6a.tar.bz2
hw/net: Fix read of uninitialized memory in ftgmac100
With the `size += 4` before the call to `crc32`, the CRC calculation would overrun the buffer. Size is used in the while loop starting on line 1009 to determine how much data to write back, with the last four bytes coming from `crc_ptr`, so do need to increase it, but should do this after the computation. I'm unsure why this use of uninitialized memory in the CRC doesn't result in CRC errors, but it seems clear to me that it should not be included in the calculation. Signed-off-by: Stephen Longfield <slongfield@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20221220221437.3303721-1-slongfield@google.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Diffstat (limited to 'tests')
0 files changed, 0 insertions, 0 deletions