| commit | d88d3a093898bd1dc0898c7c87b0d3f555a24a6e | |
| author | Prasad J Pandit <pjp@fedoraproject.org> | |
| Wed, 8 Jun 2016 10:37:04 +0000 (8 16:07 +0530) | ||
| committer | Jason Wang <jasowang@redhat.com> | |
| Tue, 28 Jun 2016 02:13:57 +0000 (28 10:13 +0800) | ||
| tree | 51445f4200a6ffffae73ac95d5801d17dfbd2abd | treesnapshot (tar.gz zip) |
| parent | ca1ee3d6b546e841a1b9db413eb8fa09f13a061b | commitdiff |
net: mipsnet: check transmit buffer size before sending
When processing MIPSnet I/O port write operation, it uses a
transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
's->tx_written' and 's->tx_count' are used to control data written
to this buffer. If the two were to be equal before writing, it'd
lead to an OOB write access beyond tx_buffer. Add check to avoid it.
Reported-by: Li Qiang <qiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
When processing MIPSnet I/O port write operation, it uses a
transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
's->tx_written' and 's->tx_count' are used to control data written
to this buffer. If the two were to be equal before writing, it'd
lead to an OOB write access beyond tx_buffer. Add check to avoid it.
Reported-by: Li Qiang <qiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| hw/net/mipsnet.c | diffblobblamehistory |