Commit d88d3a09 authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Jason Wang
Browse files

net: mipsnet: check transmit buffer size before sending 



When processing MIPSnet I/O port write operation, it uses a
transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
's->tx_written' and 's->tx_count' are used to control data written
to this buffer. If the two were to be equal before writing, it'd
lead to an OOB write access beyond tx_buffer. Add check to avoid it.

Reported-by: default avatarLi Qiang <qiang6-s@360.cn>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent ca1ee3d6

hw/net/mipsnet.c

+5 −3
Original line number Diff line number Diff line
@@ -183,10 +183,12 @@ static void mipsnet_ioport_write(void *opaque, hwaddr addr, 
        break;

    case MIPSNET_TX_DATA_BUFFER:

        s->tx_buffer[s->tx_written++] = val;

        if (s->tx_written == s->tx_count) {

        if ((s->tx_written >= MAX_ETH_FRAME_SIZE)

            || (s->tx_written == s->tx_count)) {

            /* Send buffer. */

            trace_mipsnet_send(s->tx_count);

            qemu_send_packet(qemu_get_queue(s->nic), s->tx_buffer, s->tx_count);

            trace_mipsnet_send(s->tx_written);

            qemu_send_packet(qemu_get_queue(s->nic),

                                s->tx_buffer, s->tx_written);

            s->tx_count = s->tx_written = 0;

            s->intctl |= MIPSNET_INTCTL_TXDONE;

            s->busy = 1;