From: Prasad J Pandit Date: Mon, 28 Dec 2015 10:54:08 +0000 (+0530) Subject: net: rocker: fix an incorrect array bounds check X-Git-Tag: qemu-xen-4.7.0-rc1~12 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=a890821b79ccf2f0c5bb60253d70f72f91e52e4c;p=qemu-xen.git net: rocker: fix an incorrect array bounds check While processing transmit(tx) descriptors in 'tx_consume' routine the switch emulator suffers from an off-by-one error, if a descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX=16) fragments. Fix an incorrect bounds check to avoid it. Reported-by: Qinghao Tang Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit Signed-off-by: Jason Wang --- diff --git a/hw/net/rocker/rocker.c b/hw/net/rocker/rocker.c index 47d080fd33..7e4ec0a747 100644 --- a/hw/net/rocker/rocker.c +++ b/hw/net/rocker/rocker.c @@ -234,6 +234,9 @@ static int tx_consume(Rocker *r, DescInfo *info) frag_addr = rocker_tlv_get_le64(tlvs[ROCKER_TLV_TX_FRAG_ATTR_ADDR]); frag_len = rocker_tlv_get_le16(tlvs[ROCKER_TLV_TX_FRAG_ATTR_LEN]); + if (iovcnt >= ROCKER_TX_FRAGS_MAX) { + goto err_too_many_frags; + } iov[iovcnt].iov_len = frag_len; iov[iovcnt].iov_base = g_malloc(frag_len); if (!iov[iovcnt].iov_base) { @@ -246,10 +249,7 @@ static int tx_consume(Rocker *r, DescInfo *info) err = -ROCKER_ENXIO; goto err_bad_io; } - - if (++iovcnt > ROCKER_TX_FRAGS_MAX) { - goto err_too_many_frags; - } + iovcnt++; } if (iovcnt) {