[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] hw/net/i82596.c: Avoid reading off end of buffer in i82596_r
Re: [PATCH] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()
Fri, 27 Mar 2020 10:10:05 +0800
Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0
On 2020/3/27 上午5:11, Peter Maydell wrote:
On Tue, 17 Mar 2020 at 06:13, Jason Wang <address@hidden> wrote:
On 2020/3/13 上午4:16, Peter Maydell wrote:
The i82596_receive() function attempts to pass the guest a buffer
which is effectively the concatenation of the data it is passed and a
4 byte CRC value. However, rather than implementing this as "write
the data; then write the CRC" it instead bumps the length value of
the data by 4, and writes 4 extra bytes from beyond the end of the
buffer, which it then overwrites with the CRC. It also assumed that
we could always fit all four bytes of the CRC into the final receive
buffer, which might not be true if the CRC needs to be split over two
Hi Jason -- this doesn't seem to have reached master yet.
Has it gotten lost somewhere along the line?
Nope, it's in my queue.
I will send a pull request shortly.