mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hw/net: Fix read of uninitialized memory in imx_fec.

Browse Source 
Size is used at lines 1088/1188 for the loop, which reads the last 4
bytes from the crc_ptr so it does need to get increased, however it
shouldn't be increased before the buffer is passed to CRC computation,
or the crc32 function will access uninitialized memory.

This was pointed out to me by clg@kaod.org during the code review of
a similar patch to hw/net/ftgmac100.c

Change-Id: Ib0464303b191af1e28abeb2f5105eb25aadb5e9b
Signed-off-by: Stephen Longfield <slongfield@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20221221183202.3788132-1-slongfield@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Stephen Longfield 2022-12-21 10:32:02 -08:00 committed by Peter Maydell
parent c73c279830
commit 93c9678de9
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hw/net/imx_fec.c
View File

@ -1068,9 +1068,9 @@ static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf,
return 0; return 0;
} }
/* 4 bytes for the CRC. */
size += 4;
crc = cpu_to_be32(crc32(~0, buf, size)); crc = cpu_to_be32(crc32(~0, buf, size));
/* Increase size by 4, loop below reads the last 4 bytes from crc_ptr. */
size += 4;
crc_ptr = (uint8_t *) &crc; crc_ptr = (uint8_t *) &crc;
/* Huge frames are truncated. */ /* Huge frames are truncated. */
@ -1164,9 +1164,9 @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
return 0; return 0;
} }
/* 4 bytes for the CRC. */
size += 4;
crc = cpu_to_be32(crc32(~0, buf, size)); crc = cpu_to_be32(crc32(~0, buf, size));
/* Increase size by 4, loop below reads the last 4 bytes from crc_ptr. */
size += 4;
crc_ptr = (uint8_t *) &crc; crc_ptr = (uint8_t *) &crc;
if (shift16) { if (shift16) {