a6a1ef
From 00837731d254908a841d69298a4f9f077babaf24 Mon Sep 17 00:00:00 2001
a6a1ef
From: Stefan Weil <sw@weilnetz.de>
a6a1ef
Date: Fri, 20 Nov 2015 08:42:33 +0100
a6a1ef
Subject: [PATCH] eepro100: Prevent two endless loops
a6a1ef
a6a1ef
http://lists.nongnu.org/archive/html/qemu-devel/2015-11/msg04592.html
a6a1ef
shows an example how an endless loop in function action_command can
a6a1ef
be achieved.
a6a1ef
a6a1ef
During my code review, I noticed a 2nd case which can result in an
a6a1ef
endless loop.
a6a1ef
a6a1ef
Reported-by: Qinghao Tang <luodalongde@gmail.com>
a6a1ef
Signed-off-by: Stefan Weil <sw@weilnetz.de>
a6a1ef
Signed-off-by: Jason Wang <jasowang@redhat.com>
a6a1ef
---
a6a1ef
 tools/qemu-xen-traditional/hw/eepro100.c |   16 ++++++++++++++++
a6a1ef
 1 files changed, 16 insertions(+), 0 deletions(-)
a6a1ef
a6a1ef
diff --git a/tools/qemu-xen-traditional/hw/eepro100.c b/tools/qemu-xen-traditional/hw/eepro100.c
a6a1ef
index 60333b7..685a478 100644
a6a1ef
--- a/tools/qemu-xen-traditional/hw/eepro100.c
a6a1ef
+++ b/tools/qemu-xen-traditional/hw/eepro100.c
a6a1ef
@@ -774,6 +774,11 @@ static void tx_command(EEPRO100State *s)
a6a1ef
                 uint32_t tx_buffer_address = ldl_phys(tbd_address);
a6a1ef
                 uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
a6a1ef
                 //~ uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
a6a1ef
+                if (tx_buffer_size == 0) {
a6a1ef
+                    /* Prevent an endless loop. */
a6a1ef
+                    logout("loop in %s:%u\n", __FILE__, __LINE__);
a6a1ef
+                    break;
a6a1ef
+                }
a6a1ef
                 tbd_address += 8;
a6a1ef
                 logout
a6a1ef
                     ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
a6a1ef
-- 
a6a1ef
1.7.0.4
a6a1ef