Michael S. Tsirkin d7f053652f cadence_gem: fix buffer overflow ...

gem_transmit copies a packet from guest into an tx_packet[2048]
array on stack, with size limited by descriptor length set by guest.  If
guest is malicious and specifies a descriptor length that is too large,
and should packet size exceed array size, this results in a buffer
overflow.

Reported-by: 刘令 <liuling-it@360.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>

2016-02-04 13:22:06 +08:00

..

fsl_etsec

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

rocker

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

allwinner_emac.c

arm: Clean up includes

2016-01-29 15:07:23 +00:00

cadence_gem.c

cadence_gem: fix buffer overflow

2016-02-04 13:22:06 +08:00

dp8393x.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

e1000_regs.h

e1000: Trivial implementation of various MAC registers

2015-11-12 15:26:53 +08:00

e1000.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

eepro100.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

etraxfs_eth.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

imx_fec.c

arm: Clean up includes

2016-01-29 15:07:23 +00:00

lan9118.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

lance.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

Makefile.objs

i.MX: Add FEC Ethernet Emulator

2015-09-07 10:39:30 +01:00

mcf_fec.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

milkymist-minimac2.c

lm32: Clean up includes

2016-01-29 15:07:22 +00:00

mipsnet.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

ne2000-isa.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

ne2000.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

ne2000.h

ne2000: Drop ne2000_can_receive

2015-09-02 14:51:07 +01:00

opencores_eth.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

pcnet-pci.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

pcnet.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

pcnet.h

pcnet: Drop pcnet_can_receive

2015-07-27 14:12:18 +01:00

rtl8139.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

smc91c111.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

spapr_llan.c

ppc: Clean up includes

2016-01-29 15:07:22 +00:00

stellaris_enet.c

arm: Clean up includes

2016-01-29 15:07:23 +00:00

vhost_net.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

virtio-net.c

virtio: Clean up includes

2016-01-29 15:07:23 +00:00

vmware_utils.h

fpu: Replace uint8 typedef with uint8_t

2016-01-22 15:09:21 +00:00

vmxnet3.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

vmxnet3.h

vmxnet3: Add support for VMXNET3_CMD_GET_ADAPTIVE_RING_INFO command

2015-10-12 13:19:29 +08:00

vmxnet_debug.h

net/vmxnet3: fix debug macro pattern for vmxnet3

2016-01-11 11:01:34 +08:00

vmxnet_rx_pkt.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

vmxnet_rx_pkt.h

net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'

2015-07-20 17:39:05 +01:00

vmxnet_tx_pkt.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

vmxnet_tx_pkt.h

…

xen_nic.c

xen: Clean up includes

2016-01-29 15:07:23 +00:00

xgmac.c

arm: Clean up includes

2016-01-29 15:07:23 +00:00

xilinx_axienet.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00

xilinx_ethlite.c

hw/net: Clean up includes

2016-01-29 15:07:23 +00:00