openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity
qemu/hw
History
Peter Maydell a43790f2f6 hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive() 
The i82596_receive() function attempts to pass the guest a buffer
which is effectively the concatenation of the data it is passed and a
4 byte CRC value.  However, rather than implementing this as "write
the data; then write the CRC" it instead bumps the length value of
the data by 4, and writes 4 extra bytes from beyond the end of the
buffer, which it then overwrites with the CRC.  It also assumed that
we could always fit all four bytes of the CRC into the final receive
buffer, which might not be true if the CRC needs to be split over two
receive buffers.

Calculate separately how many bytes we need to transfer into the
guest's receive buffer from the source buffer, and how many we need
to transfer from the CRC work.

We add a count 'bufsz' of the number of bytes left in the source
buffer, which we use purely to assert() that we don't overrun.

Spotted by Coverity (CID 1419396) for the specific case when we end
up using a local array as the source buffer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
 		2020-03-31 21:14:35 +08:00
..
9pfs 9p/proxy: Fix export_flags 2020-03-10 16:12:49 +01:00
acpi qom/object: Use common get/set uint helpers 2020-03-16 23:02:24 +01:00
adc hw/*/Makefile.objs: Move many .o files to common-objs 2020-02-04 09:00:57 +01:00
alpha hw/ide: Do ide_drive_get() within pci_ide_create_devs() 2020-03-17 12:22:36 -04:00
arm hw/arm/xlnx-zynqmp.c: Add missing error-propagation code 2020-03-30 13:18:59 +01:00
audio hw/audio/fmopl: fix segmentation fault 2020-03-25 09:55:40 +01:00
block Pull request 2020-03-28 00:27:04 +00:00
char hw/char: Let devices own the MemoryRegion they create 2020-03-17 15:18:49 +01:00
core compat: disable edid on correct virtio-gpu device 2020-03-20 07:50:52 +01:00
cpu cpu/arm11mpcore: Set number of GIC priority bits to 4 2020-02-28 16:14:57 +00:00
cris hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
display hw/arm/bcm283x: Correct the license text 2020-03-23 17:22:30 +00:00
dma fdc/i8257: implement verify transfer mode 2020-03-27 14:30:08 -04:00
gpio hw/*/Makefile.objs: Move many .o files to common-objs 2020-02-04 09:00:57 +01:00
hppa hw/ide: Remove unneeded inclusion of hw/ide.h 2020-03-17 12:22:36 -04:00
hyperv add device_legacy_reset function to prepare for reset api change 2020-01-30 16:02:03 +00:00
i2c hw/i2c/smbus_ich9: Include "qemu/range.h" 2020-03-09 15:59:31 +01:00
i386 x86 and machine queue for 5.0 soft freeze 2020-03-19 14:22:46 +00:00
ide cmd646-ide: use qdev gpio rather than qemu_allocate_irqs() 2020-03-27 14:30:08 -04:00
input hw/input: Do not enable CONFIG_PCKBD by default 2020-02-04 09:01:31 +01:00
intc hw/arm/bcm283x: Correct the license text 2020-03-23 17:22:30 +00:00
ipack qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
ipmi qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
isa Pull request 2020-03-19 11:14:24 +00:00
lm32 hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
m68k hw/m68k: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:47 +01:00
mem spapr: Add NVDIMM device support 2020-02-21 09:15:04 +11:00
microblaze hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
mips hw/ide: Remove unneeded inclusion of hw/ide.h 2020-03-17 12:22:36 -04:00
misc hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address 2020-03-30 13:18:58 +01:00
moxie hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
net hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive() 2020-03-31 21:14:35 +08:00
nios2 hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
nubus hw/m68k: add Nubus support 2019-10-28 19:06:47 +01:00
nvram misc: Replace zero-length arrays with flexible array member (automatic) 2020-03-16 22:07:42 +01:00
openrisc hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
pci pci: Honour wmask when resetting PCI_INTERRUPT_LINE 2020-03-16 21:08:21 -04:00
pci-bridge pcie_root_port: Add hotplug disabling option 2020-03-08 09:18:29 -04:00
pci-host hw/pci-host: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:47 +01:00
pcmcia hw/*/Makefile.objs: Move many .o files to common-objs 2020-02-04 09:00:57 +01:00
ppc ppc/ppc405_boards: Remove unnecessary NULL check 2020-03-24 11:56:37 +11:00
rdma hw/rdma: avoid suspicious strncpy() use 2020-03-21 19:21:20 +02:00
riscv * Bugfixes all over the place 2020-03-17 18:33:05 +00:00
rtc hw/arm/allwinner: add RTC device support 2020-03-12 16:27:33 +00:00
s390x s390/ipl: fix off-by-one in update_machine_ipl_properties() 2020-03-23 12:36:27 +01:00
scsi hw/scsi/spapr_vscsi: Convert debug fprintf() to trace event 2020-03-17 15:08:50 +11:00
sd hw/sd/ssi-sd: fix error handling in ssi_sd_realize 2020-03-17 17:30:03 +01:00
semihosting semihosting: add qemu_semihosting_console_inc for SYS_READC 2020-01-09 11:41:29 +00:00
sh4 hw/sh4: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:47 +01:00
smbios hw/smbios/smbios: Remove unused include 2020-02-06 10:38:57 +01:00
sparc hw/sparc: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:48 +01:00
sparc64 hw/ide: Do ide_drive_get() within pci_ide_create_devs() 2020-03-17 12:22:36 -04:00
ssi aspeed/smc: Fix DMA support for AST2600 2020-03-23 17:22:30 +00:00
timer hw/timer/hpet: Include "exec/address-spaces.h" 2020-03-09 15:59:31 +01:00
tpm tpm: Add the SysBus TPM TIS device 2020-03-05 12:18:08 -05:00
tricore hw: Do not initialize MachineClass::is_default to 0 2020-02-28 14:57:19 -05:00
unicore32 hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
usb * Bugfixes all over the place 2020-03-17 18:33:05 +00:00
vfio hw/vfio/display: Remove superfluous semicolon 2020-02-18 20:20:49 +01:00
virtio misc: Replace zero-length arrays with flexible array member (automatic) 2020-03-16 22:07:42 +01:00
watchdog qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
xen misc: Replace zero-length arrays with flexible array member (automatic) 2020-03-16 22:07:42 +01:00
xenpv trivial: Remove xenfb_enabled from sysemu.h 2020-02-04 09:00:57 +01:00
xtensa hw/xtensa/xtfpga:fix leak of fdevice tree blob 2020-02-19 10:33:38 +01:00
Kconfig Remove the core bluetooth code 2019-12-17 09:01:14 +01:00
Makefile.objs Remove the core bluetooth code 2019-12-17 09:01:14 +01:00