From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Fri, 15 Jan 2016 07:00:40 +0000 (+0530)
Subject: net: cadence_gem: check packet size in gem_recieve
X-Git-Tag: qemu-xen-4.7.0-rc1~9
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=ec963204db85b8e7c5758c76a9ec7d21eb256925;p=qemu-xen.git

net: cadence_gem: check packet size in gem_recieve

While receiving packets in 'gem_receive' routine, if Frame Check
Sequence(FCS) is enabled, it copies the packet into a local
buffer without checking its size. Add check to validate packet
length against the buffer size to avoid buffer overflow.

Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 494a346cf6..edba1fc044 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -677,6 +677,10 @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     } else {
         unsigned crc_val;
 
+        if (size > sizeof(rxbuf) - sizeof(crc_val)) {
+            size = sizeof(rxbuf) - sizeof(crc_val);
+        }
+        bytes_to_copy = size;
         /* The application wants the FCS field, which QEMU does not provide.
          * We must try and calculate one.
          */