david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Insufficient input validation in NE2000 card, written by Tavis Ormandy,

Browse Source 
contributed by Aurelien Jarno.


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@3019 c046a42c-6fe2-441c-8c8c-71466251a162
This commit is contained in:
ths 2007-06-25 13:47:44 +00:00
parent aec62507bb
commit 0ae045ae43
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/ne2000.c
View File

@ -224,7 +224,7 @@ static void ne2000_receive(void *opaque, const uint8_t *buf, int size)
{ {
NE2000State *s = opaque; NE2000State *s = opaque;
uint8_t *p; uint8_t *p;
int total_len, next, avail, len, index, mcast_idx; unsigned int total_len, next, avail, len, index, mcast_idx;
uint8_t buf1[60]; uint8_t buf1[60];
static const uint8_t broadcast_macaddr[6] = static const uint8_t broadcast_macaddr[6] =
{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
@ -293,7 +293,10 @@ static void ne2000_receive(void *opaque, const uint8_t *buf, int size)
/* write packet data */ /* write packet data */
while (size > 0) { while (size > 0) {
if (index <= s->stop)
avail = s->stop - index; avail = s->stop - index;
else
avail = 0;
len = size; len = size;
if (len > avail) if (len > avail)
len = avail; len = avail;