diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2016-04-11 14:37:53 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2016-04-11 14:37:53 +0100 |
| commit | dc1ffa66619b3661f17a309b0aa8d65d8d29583f (patch) | |
| tree | b6710f8c71ea355b2c4f902f456f331cc6775ce9 | |
| parent | 5144fe36056d3a94b0d8da9e10adc555c057baa8 (diff) | |
| parent | 3a15cc0e1ee7168db0782133d2607a6bfa422d66 (diff) | |
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20160411' into staging
target-arm queue:
* stellaris_enet: don't overrun buffer if fed oversize packet
# gpg: Signature made Mon 11 Apr 2016 14:36:27 BST using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg: aka "Peter Maydell <pmaydell@gmail.com>"
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
* remotes/pmaydell/tags/pull-target-arm-20160411:
net: stellaris_enet: check packet length against receive buffer
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/net/stellaris_enet.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c index 84cf60b303..6880894945 100644 --- a/hw/net/stellaris_enet.c +++ b/hw/net/stellaris_enet.c @@ -236,8 +236,18 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si n = s->next_packet + s->np; if (n >= 31) n -= 31; - s->np++; + if (size >= sizeof(s->rx[n].data) - 6) { + /* If the packet won't fit into the + * emulated 2K RAM, this is reported + * as a FIFO overrun error. + */ + s->ris |= SE_INT_FOV; + stellaris_enet_update(s); + return -1; + } + + s->np++; s->rx[n].len = size + 6; p = s->rx[n].data; *(p++) = (size + 6); |