Commit 0ae045ae authored by ths's avatar ths
Browse files

Insufficient input validation in NE2000 card, written by Tavis Ormandy,

contributed by Aurelien Jarno.


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@3019 c046a42c-6fe2-441c-8c8c-71466251a162
parent aec62507
......@@ -224,7 +224,7 @@ static void ne2000_receive(void *opaque, const uint8_t *buf, int size)
{
NE2000State *s = opaque;
uint8_t *p;
int total_len, next, avail, len, index, mcast_idx;
unsigned int total_len, next, avail, len, index, mcast_idx;
uint8_t buf1[60];
static const uint8_t broadcast_macaddr[6] =
{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
......@@ -293,7 +293,10 @@ static void ne2000_receive(void *opaque, const uint8_t *buf, int size)
/* write packet data */
while (size > 0) {
avail = s->stop - index;
if (index <= s->stop)
avail = s->stop - index;
else
avail = 0;
len = size;
if (len > avail)
len = avail;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment