From ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05 Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Thu, 4 Aug 2016 13:00:14 +0530 Subject: [PATCH] net: check fragment length during fragmentation Network transport abstraction layer supports packet fragmentation. While fragmenting a packet, it checks for more fragments from packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang Signed-off-by: Prasad J Pandit Reviewed-by: Dmitry Fleytman CC: qemu-stable@nongnu.org Signed-off-by: Jason Wang --- hw/net/net_tx_pkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c index efd43b47b8..53dfaa292c 100644 --- a/hw/net/net_tx_pkt.c +++ b/hw/net/net_tx_pkt.c @@ -590,7 +590,7 @@ static bool net_tx_pkt_do_sw_fragmentation(struct NetTxPkt *pkt, fragment_offset += fragment_len; - } while (more_frags); + } while (fragment_len && more_frags); return true; } -- 2.11.4.GIT