Blame xen-qemu-ne2000-CVE-2007-1321.patch
|
 |
886e707 |
diff -up xen-3.0.3_0-src/tools/ioemu/hw/ne2000.c.cve xen-3.0.3_0-src/tools/ioemu/hw/ne2000.c
|
|
|
886e707 |
--- xen-3.0.3_0-src/tools/ioemu/hw/ne2000.c.cve 2007-09-25 10:27:44.000000000 -0400
|
|
|
886e707 |
+++ xen-3.0.3_0-src/tools/ioemu/hw/ne2000.c 2007-09-25 10:27:47.000000000 -0400
|
|
|
886e707 |
@@ -252,7 +252,7 @@ static void ne2000_receive(void *opaque,
|
|
|
886e707 |
{
|
|
|
886e707 |
NE2000State *s = opaque;
|
|
|
886e707 |
uint8_t *p;
|
|
|
886e707 |
- int total_len, next, avail, len, index, mcast_idx;
|
|
|
886e707 |
+ unsigned int total_len, next, avail, len, index, mcast_idx;
|
|
|
886e707 |
uint8_t buf1[60];
|
|
|
886e707 |
static const uint8_t broadcast_macaddr[6] =
|
|
|
886e707 |
{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
|
|
|
886e707 |
@@ -327,7 +327,10 @@ static void ne2000_receive(void *opaque,
|
|
|
886e707 |
|
|
|
886e707 |
/* write packet data */
|
|
|
886e707 |
while (size > 0) {
|
|
|
886e707 |
- avail = s->stop - index;
|
|
|
886e707 |
+ if (index <= s->stop)
|
|
|
886e707 |
+ avail = s->stop - index;
|
|
|
886e707 |
+ else
|
|
|
886e707 |
+ avail = 0;
|
|
|
886e707 |
len = size;
|
|
|
886e707 |
if (len > avail)
|
|
|
886e707 |
len = avail;
|