haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
qemu-patch-raspberry4/hw/net
History
Peter Maydell a43790f2f6 hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive() 
The i82596_receive() function attempts to pass the guest a buffer
which is effectively the concatenation of the data it is passed and a
4 byte CRC value.  However, rather than implementing this as "write
the data; then write the CRC" it instead bumps the length value of
the data by 4, and writes 4 extra bytes from beyond the end of the
buffer, which it then overwrites with the CRC.  It also assumed that
we could always fit all four bytes of the CRC into the final receive
buffer, which might not be true if the CRC needs to be split over two
receive buffers.

Calculate separately how many bytes we need to transfer into the
guest's receive buffer from the source buffer, and how many we need
to transfer from the CRC work.

We add a count 'bufsz' of the number of bytes left in the source
buffer, which we use purely to assert() that we don't overrun.

Spotted by Coverity (CID 1419396) for the specific case when we end
up using a local array as the source buffer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-03-31 21:14:35 +08:00
..
can qemu_log_lock/unlock now preserves the qemu_logfile handle. 2019-12-18 20:18:02 +00:00
fsl_etsec qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
rocker hw/net/rocker: Report unimplemented feature with qemu_log_mask(UNIMP) 2020-02-18 20:20:49 +01:00
allwinner-sun8i-emac.c hw/arm/allwinner-h3: add EMAC ethernet device 2020-03-12 16:27:33 +00:00
allwinner_emac.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
cadence_gem.c hw: net: cadence_gem: Fix build errors in DB_PRINT() 2020-03-03 18:04:47 +08:00
dp8393x.c hw/net: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:47 +01:00
e1000.c hw/net/e1000: Move macreg[] arrays to .rodata to save 1MiB of .data 2020-03-09 15:59:31 +01:00
e1000_regs.h e1000: Rename the SEC symbol to SEQEC 2017-09-08 08:17:37 +08:00
e1000e.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
e1000e_core.c hw/net/e1000: Move macreg[] arrays to .rodata to save 1MiB of .data 2020-03-09 15:59:31 +01:00
e1000e_core.h Supply missing header guards 2019-06-12 13:20:21 +02:00
e1000x_common.c Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
e1000x_common.h Supply missing header guards 2019-06-12 13:20:21 +02:00
eepro100.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
etraxfs_eth.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
ftgmac100.c ftgmac100: check RX and TX buffer alignment 2020-01-30 16:02:02 +00:00
i82596.c hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive() 2020-03-31 21:14:35 +08:00
i82596.h hppa: Add support for LASI chip with i82596 NIC 2020-01-27 10:49:51 -08:00
imx_fec.c hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write() 2020-03-17 11:23:14 +00:00
Kconfig hw/arm/allwinner-h3: add EMAC ethernet device 2020-03-12 16:27:33 +00:00
lan9118.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
lance.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
lasi_i82596.c Avoid address_space_rw() with a constant is_write argument 2020-02-20 14:47:08 +01:00
Makefile.objs hw/arm/allwinner-h3: add EMAC ethernet device 2020-03-12 16:27:33 +00:00
mcf_fec.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
milkymist-minimac2.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
mipsnet.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
ne2000-isa.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
ne2000-pci.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
ne2000.c Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
ne2000.h Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
net_rx_pkt.c NetRxPkt: fix hash calculation of IPV6 TCP 2020-03-03 18:04:47 +08:00
net_rx_pkt.h NetRxPkt: Introduce support for additional hash types 2020-03-03 18:04:47 +08:00
net_tx_pkt.c net: fix misaligned member access 2018-03-02 18:44:00 +00:00
net_tx_pkt.h clean-includes: run it once more 2016-06-16 18:39:03 +02:00
opencores_eth.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
pcnet-pci.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
pcnet.c Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
pcnet.h lance: replace PROP_PTR with PROP_LINK 2020-01-07 17:24:29 +04:00
rtl8139.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
smc91c111.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
spapr_llan.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
stellaris_enet.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
sungem.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
sunhme.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
trace-events hw/arm/allwinner-h3: add EMAC ethernet device 2020-03-12 16:27:33 +00:00
tulip.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
tulip.h net: add tulip (dec21143) driver 2019-10-29 10:28:07 +08:00
vhost_net-stub.c vhost-net: move stubs to a separate file 2019-02-21 12:28:01 -05:00
vhost_net.c vhost_net: enable packed ring support 2019-10-25 07:46:22 -04:00
virtio-net.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
vmware_utils.h hw/net/vmxnet3: Fix code to work on big endian hosts, too 2017-11-20 11:08:00 +08:00
vmxnet3.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
vmxnet3.h hw/net/vmxnet3: Fix code to work on big endian hosts, too 2017-11-20 11:08:00 +08:00
vmxnet3_defs.h Supply missing header guards 2019-06-12 13:20:21 +02:00
vmxnet_debug.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
xen_nic.c Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
xgmac.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
xilinx_axienet.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
xilinx_ethlite.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00