mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: mipsnet: check transmit buffer size before sending

Browse Source 
When processing MIPSnet I/O port write operation, it uses a
transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
's->tx_written' and 's->tx_count' are used to control data written
to this buffer. If the two were to be equal before writing, it'd
lead to an OOB write access beyond tx_buffer. Add check to avoid it.

Reported-by: Li Qiang <qiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
This commit is contained in:
Prasad J Pandit 2016-06-08 16:07:04 +05:30 committed by Jason Wang
parent ca1ee3d6b5
commit d88d3a0938
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hw/net/mipsnet.c
View File

@ -183,10 +183,12 @@ static void mipsnet_ioport_write(void *opaque, hwaddr addr,
break; break;
case MIPSNET_TX_DATA_BUFFER: case MIPSNET_TX_DATA_BUFFER:
s->tx_buffer[s->tx_written++] = val; s->tx_buffer[s->tx_written++] = val;
if (s->tx_written == s->tx_count) { if ((s->tx_written >= MAX_ETH_FRAME_SIZE)
|| (s->tx_written == s->tx_count)) {
/* Send buffer. */ /* Send buffer. */
trace_mipsnet_send(s->tx_count); trace_mipsnet_send(s->tx_written);
qemu_send_packet(qemu_get_queue(s->nic), s->tx_buffer, s->tx_count); qemu_send_packet(qemu_get_queue(s->nic),
s->tx_buffer, s->tx_written);
s->tx_count = s->tx_written = 0; s->tx_count = s->tx_written = 0;
s->intctl |= MIPSNET_INTCTL_TXDONE; s->intctl |= MIPSNET_INTCTL_TXDONE;
s->busy = 1; s->busy = 1;