mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

target-arm queue:

Browse Source 
* stellaris_enet: don't overrun buffer if fed oversize packet
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJXC6hbAAoJEDwlJe0UNgzelokP/0JJ3gCRvGu7dsIibuHxsPpo
 UCwyb8zVylDnaHC1ntGBTK/vdMkErsbsXM15CcG4BzBLKm2+to9cqqzDWreA8g2a
 lCgSqYiuifvazkHT6T+nx8lxrBlIqscJVOCrX18vBF4C+o5OOgbZXK0uwJdesg46
 jpm0dBvD4RpW8m0UV5xGQnTcrLju8xFnkOjjQthldOlLHftNmeV0xxdySns1+Cch
 YxEjmjhLfY+HhVdHv+fsNKyMHTT5rqJ9Dbbo/B+nGLDbgZObGc/Vo5mbV9Iw1m+Q
 Q42migAH82zK2ySwP6J0+w1KtGo22Np+HVvX774RTf8jcA8HUDXNsdPVpkYg1mYm
 /+BwTO/bIyo9tZMp+togYYN8YI92KJY3Kj+wilwM03I11pXxD3BkmCIo/Pwmkp/+
 cjOI8Nws6xymDrCMYmUL69WlsyN6ED2dxO4FrIgmstksUKM4v9rhJ4f9J5NtbFl+
 Yg79l7FhxZdbKWkKG7HDlsbF77Q/Zpfhll4tmuEaIvjrjLHUopsgprtTEYV7zEH+
 3SeqotwS52wN0KD61PCMgklHTe3LBtN3Rlpwd0epQPkZlbh/7SoHZPzxOvlI3x1T
 x/yu5muCU6Rwm3UhYc5guhcxZwAvFFLKhUCDMi2EpdaTmt+4i5syVIONk9nj7j4i
 XgqYQYZ7cGQfPO+/UCyT
 =Vpkq
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20160411' into staging

target-arm queue:
 * stellaris_enet: don't overrun buffer if fed oversize packet

# gpg: Signature made Mon 11 Apr 2016 14:36:27 BST using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"

* remotes/pmaydell/tags/pull-target-arm-20160411:
  net: stellaris_enet: check packet length against receive buffer

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2016-04-11 14:37:53 +01:00
commit dc1ffa6661
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
hw/net/stellaris_enet.c
View File

@ -236,8 +236,18 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si
n = s->next_packet + s->np;
if (n >= 31)
n -= 31;
s->np++;
if (size >= sizeof(s->rx[n].data) - 6) {
/* If the packet won't fit into the
* emulated 2K RAM, this is reported
* as a FIFO overrun error.
*/
s->ris |= SE_INT_FOV;
stellaris_enet_update(s);
return -1;
}
s->np++;
s->rx[n].len = size + 6;
p = s->rx[n].data;
*(p++) = (size + 6);