Cédric Le Goater c2ab73fcbe ftgmac100: Fix integer overflow in ftgmac100_do_tx() ... When inserting the VLAN tag in packets, memmove() can generate an integer overflow for packets whose length is less than 12 bytes. Move the VLAN insertion when the last segment of the frame is reached and check length against the size of the ethernet header (14 bytes) to avoid the crash. Return FTGMAC100_INT_XPKT_LOST status if the frame is too small. This seems like a good modeling choice even if Aspeed does not specify anything in that case. Cc: Frederic Konrad <konrad.frederic@yahoo.fr> Cc: Mauro Matteo Cascella <mcascell@redhat.com> Reported-by: Ziming Zhang <ezrakiez@gmail.com> Message-Id: <20200819100956.2216690-15-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>		2020-09-01 14:21:50 +02:00
..
can	meson: convert hw/net	2020-08-21 06:30:29 -04:00
fsl_etsec	etsec: Use TYPE_ETSEC_COMMON constant	2020-08-27 14:21:48 -04:00
rocker	rocker: Move QOM macros to header	2020-08-27 14:04:55 -04:00
allwinner_emac.c	hw/net: Make NetCanReceive() return a boolean	2020-03-31 21:14:35 +08:00
allwinner-sun8i-emac.c	hw/net/allwinner-sun8i-emac: Use AddressSpace for DMA transfers	2020-08-28 10:02:45 +01:00
cadence_gem.c	net: cadence_gem: Fix RX address filtering	2020-06-18 21:05:52 +08:00
dp8393x.c	hw/net: Make NetCanReceive() return a boolean	2020-03-31 21:14:35 +08:00
e1000_regs.h	e1000: Rename the SEC symbol to SEQEC	2017-09-08 08:17:37 +08:00
e1000.c	e1000: Rename QOM class cast macros	2020-08-27 14:04:54 -04:00
e1000e_core.c	hw/net/e1000e: Do not abort() on invalid PSRCTL register value	2020-06-18 21:05:52 +08:00
e1000e_core.h	hw/net/e1000e_core: Let e1000e_can_receive() return a boolean	2020-03-31 21:14:35 +08:00
e1000e.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
e1000x_common.c	Include hw/hw.h exactly where needed	2019-08-16 13:31:52 +02:00
e1000x_common.h	Supply missing header guards	2019-06-12 13:20:21 +02:00
eepro100.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
etraxfs_eth.c	sysbus: Convert to sysbus_realize() etc. with Coccinelle	2020-06-15 22:05:28 +02:00
ftgmac100.c	ftgmac100: Fix integer overflow in ftgmac100_do_tx()	2020-09-01 14:21:50 +02:00
i82596.c	hw/net: Make NetCanReceive() return a boolean	2020-03-31 21:14:35 +08:00
i82596.h	hw/net: Make NetCanReceive() return a boolean	2020-03-31 21:14:35 +08:00
imx_fec.c	Add a phy-num property to the i.MX FEC emulator	2020-07-03 16:59:41 +01:00
Kconfig	hw/arm/allwinner-h3: add EMAC ethernet device	2020-03-12 16:27:33 +00:00
lan9118.c	sysbus: Convert to sysbus_realize() etc. with Coccinelle	2020-06-15 22:05:28 +02:00
lance.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
lasi_i82596.c	sysbus: Convert to sysbus_realize() etc. with Coccinelle	2020-06-15 22:05:28 +02:00
mcf_fec.c	mcf_fec: Move mcf_fec_state typedef to header	2020-08-27 14:04:54 -04:00
meson.build	meson: convert hw/net	2020-08-21 06:30:29 -04:00
milkymist-minimac2.c	qdev: set properties with device_class_set_props()	2020-01-24 20:59:15 +01:00
mipsnet.c	qdev: set properties with device_class_set_props()	2020-01-24 20:59:15 +01:00
msf2-emac.c	hw/net: Add Smartfusion2 emac block	2020-04-30 11:52:28 +01:00
ne2000-isa.c	qom: Put name parameter before value / visitor parameter	2020-07-10 15:18:08 +02:00
ne2000-pci.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
ne2000.c	Clean up inclusion of sysemu/sysemu.h	2019-08-16 13:31:53 +02:00
ne2000.h	Include hw/hw.h exactly where needed	2019-08-16 13:31:52 +02:00
net_rx_pkt.c	NetRxPkt: fix hash calculation of IPV6 TCP	2020-03-03 18:04:47 +08:00
net_rx_pkt.h	NetRxPkt: Introduce support for additional hash types	2020-03-03 18:04:47 +08:00
net_tx_pkt.c	hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment()	2020-08-04 14:14:48 +08:00
net_tx_pkt.h	hw/net: Added plen fix for IPv6	2020-07-21 21:30:39 +08:00
opencores_eth.c	hw/net: Make NetCanReceive() return a boolean	2020-03-31 21:14:35 +08:00
pcnet-pci.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
pcnet.c	Clean up inclusion of sysemu/sysemu.h	2019-08-16 13:31:53 +02:00
pcnet.h	lance: replace PROP_PTR with PROP_LINK	2020-01-07 17:24:29 +04:00
rtl8139.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
smc91c111.c	sysbus: Convert to sysbus_realize() etc. with Coccinelle	2020-06-15 22:05:28 +02:00
spapr_llan.c	qdev: Convert uses of qdev_create() with Coccinelle	2020-06-15 22:00:10 +02:00
stellaris_enet.c	qdev: set properties with device_class_set_props()	2020-01-24 20:59:15 +01:00
sungem.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
sunhme.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
trace-events	Add a phy-num property to the i.MX FEC emulator	2020-07-03 16:59:41 +01:00
trace.h	trace: switch position of headers to what Meson requires	2020-08-21 06:18:24 -04:00
tulip.c	tulip: Move TulipState typedef to header	2020-08-27 14:04:54 -04:00
tulip.h	tulip: Move TulipState typedef to header	2020-08-27 14:04:54 -04:00
vhost_net-stub.c	vhost_net: introduce set_config & get_config	2020-07-03 07:57:04 -04:00
vhost_net.c	vhost-vdpa: introduce vhost-vdpa backend	2020-07-07 07:59:51 -04:00
virtio-net.c	virtio-net: check the existence of peer before accessing vDPA config	2020-07-28 16:57:58 +08:00
vmware_utils.h	hw/net/vmxnet3: Fix code to work on big endian hosts, too	2017-11-20 11:08:00 +08:00
vmxnet3_defs.h	Supply missing header guards	2019-06-12 13:20:21 +02:00
vmxnet3.c	Drop more @errp parameters after previous commit	2020-05-15 07:08:14 +02:00
vmxnet3.h	hw/net/vmxnet3: Fix code to work on big endian hosts, too	2017-11-20 11:08:00 +08:00
vmxnet_debug.h	Clean up ill-advised or unusual header guards	2016-07-12 16:20:46 +02:00
xen_nic.c	Include hw/hw.h exactly where needed	2019-08-16 13:31:52 +02:00
xgmac.c	hw/net/xgmac: Fix buffer overflow in xgmac_enet_send()	2020-07-21 21:30:39 +08:00
xilinx_axienet.c	qom: Put name parameter before value / visitor parameter	2020-07-10 15:18:08 +02:00
xilinx_ethlite.c	hw/net: Make NetCanReceive() return a boolean	2020-03-31 21:14:35 +08:00