diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-02-24 11:41:33 +0530 |
|---|---|---|
| committer | Timothy Pearson <tpearson@raptorengineering.com> | 2019-11-29 19:49:12 -0600 |
| commit | 59e9bf3de350fc9a638c238adf20395df2845701 (patch) | |
| tree | bffbd3423bb687ecf7f74af0454767364a0eb99d | |
| parent | 20651d6eb8c72ebe5dcc4ce47684cd08511811ad (diff) | |
| download | hqemu-59e9bf3de350fc9a638c238adf20395df2845701.zip hqemu-59e9bf3de350fc9a638c238adf20395df2845701.tar.gz | |
net: ne2000: check ring buffer control registers
Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
bytes to process network packets. Registers PSTART & PSTOP
define ring buffer size & location. Setting these registers
to invalid values could lead to infinite loop or OOB r/w
access issues. Add check to avoid it.
Reported-by: Yang Hongke <yanghongke@huawei.com>
Tested-by: Yang Hongke <yanghongke@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| -rw-r--r-- | hw/net/ne2000.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c index e408083..f0feaf9 100644 --- a/hw/net/ne2000.c +++ b/hw/net/ne2000.c @@ -155,6 +155,10 @@ static int ne2000_buffer_full(NE2000State *s) { int avail, index, boundary; + if (s->stop <= s->start) { + return 1; + } + index = s->curpag << 8; boundary = s->boundary << 8; if (index < boundary) |
