[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 04/25] hw/net: Fix read of uninitialized memory in ftgmac100
From: |
Cédric Le Goater |
Subject: |
[PULL 04/25] hw/net: Fix read of uninitialized memory in ftgmac100 |
Date: |
Tue, 7 Feb 2023 11:07:23 +0100 |
From: Stephen Longfield <slongfield@google.com>
With the `size += 4` before the call to `crc32`, the CRC calculation
would overrun the buffer. Size is used in the while loop starting on
line 1009 to determine how much data to write back, with the last
four bytes coming from `crc_ptr`, so do need to increase it, but should
do this after the computation.
I'm unsure why this use of uninitialized memory in the CRC doesn't
result in CRC errors, but it seems clear to me that it should not be
included in the calculation.
Signed-off-by: Stephen Longfield <slongfield@google.com>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20221220221437.3303721-1-slongfield@google.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
hw/net/ftgmac100.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index 83ef0a783e..d3bf14be53 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -980,9 +980,9 @@ static ssize_t ftgmac100_receive(NetClientState *nc, const
uint8_t *buf,
return size;
}
- /* 4 bytes for the CRC. */
- size += 4;
crc = cpu_to_be32(crc32(~0, buf, size));
+ /* Increase size by 4, loop below reads the last 4 bytes from crc_ptr. */
+ size += 4;
crc_ptr = (uint8_t *) &crc;
/* Huge frames are truncated. */
--
2.39.1
- [PULL 00/25] aspeed queue, Cédric Le Goater, 2023/02/07
- [PULL 02/25] tests/avocado: Truncate M2S-FG484 SOM SPI flash to 16MiB, Cédric Le Goater, 2023/02/07
- [PULL 04/25] hw/net: Fix read of uninitialized memory in ftgmac100,
Cédric Le Goater <=
- [PULL 03/25] aspeed: Add Supermicro X11 SPI machine type, Cédric Le Goater, 2023/02/07
- [PULL 01/25] tests/avocado: Introduce file_truncate(), Cédric Le Goater, 2023/02/07
- [PULL 06/25] m25p80: Add the is25wp256 SFPD table, Cédric Le Goater, 2023/02/07
- [PULL 13/25] hw/arm/aspeed: Add aspeed_eeprom.c, Cédric Le Goater, 2023/02/07
- [PULL 11/25] hw/arm/aspeed: Replace aspeed_eeprom_init with at24c_eeprom_init, Cédric Le Goater, 2023/02/07
- [PULL 07/25] tests/avocado/machine_aspeed.py: update buildroot tests, Cédric Le Goater, 2023/02/07
- [PULL 10/25] hw/arm: Extract at24c_eeprom_init helper from Aspeed and Nuvoton boards, Cédric Le Goater, 2023/02/07
- [PULL 16/25] hw/watchdog/wdt_aspeed: Extend MMIO range to cover more registers, Cédric Le Goater, 2023/02/07
- [PULL 18/25] hw/misc/aspeed_hace: Do not crash if address_space_map() failed, Cédric Le Goater, 2023/02/07
- [PULL 14/25] hw/nvram/eeprom_at24c: Make reset behavior more like hardware, Cédric Le Goater, 2023/02/07