diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-02-24 11:41:33 +0530 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2016-03-08 15:34:09 +0800 |
| commit | 415ab35a441eca767d033a2702223e785b9d5190 (patch) | |
| tree | 5725cc8b07aefcaf7bc3d4894095e8fbae22086e | |
| parent | 97556fe80e4f7252300b3498b3477fb4295153a3 (diff) | |
net: ne2000: check ring buffer control registers
Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
bytes to process network packets. Registers PSTART & PSTOP
define ring buffer size & location. Setting these registers
to invalid values could lead to infinite loop or OOB r/w
access issues. Add check to avoid it.
Reported-by: Yang Hongke <yanghongke@huawei.com>
Tested-by: Yang Hongke <yanghongke@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| -rw-r--r-- | hw/net/ne2000.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c index e408083a58..f0feaf96b0 100644 --- a/hw/net/ne2000.c +++ b/hw/net/ne2000.c @@ -155,6 +155,10 @@ static int ne2000_buffer_full(NE2000State *s) { int avail, index, boundary; + if (s->stop <= s->start) { + return 1; + } + index = s->curpag << 8; boundary = s->boundary << 8; if (index < boundary) |