diff options
| author | Stephen Longfield <slongfield@google.com> | 2022-12-21 10:32:02 -0800 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2023-01-05 15:33:00 +0000 |
| commit | 93c9678de9dc7d2e68f9e8477da072bac30ef132 (patch) | |
| tree | 1b4d1babf6241651dc60fac8db7d4e4266000728 | |
| parent | c73c2798304916a27c21157bbc24acccdeb3c5e2 (diff) | |
hw/net: Fix read of uninitialized memory in imx_fec.pull-target-arm-20230105
Size is used at lines 1088/1188 for the loop, which reads the last 4
bytes from the crc_ptr so it does need to get increased, however it
shouldn't be increased before the buffer is passed to CRC computation,
or the crc32 function will access uninitialized memory.
This was pointed out to me by clg@kaod.org during the code review of
a similar patch to hw/net/ftgmac100.c
Change-Id: Ib0464303b191af1e28abeb2f5105eb25aadb5e9b
Signed-off-by: Stephen Longfield <slongfield@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20221221183202.3788132-1-slongfield@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/net/imx_fec.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c index 8c11b237de..c862d96593 100644 --- a/hw/net/imx_fec.c +++ b/hw/net/imx_fec.c @@ -1068,9 +1068,9 @@ static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf, return 0; } - /* 4 bytes for the CRC. */ - size += 4; crc = cpu_to_be32(crc32(~0, buf, size)); + /* Increase size by 4, loop below reads the last 4 bytes from crc_ptr. */ + size += 4; crc_ptr = (uint8_t *) &crc; /* Huge frames are truncated. */ @@ -1164,9 +1164,9 @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf, return 0; } - /* 4 bytes for the CRC. */ - size += 4; crc = cpu_to_be32(crc32(~0, buf, size)); + /* Increase size by 4, loop below reads the last 4 bytes from crc_ptr. */ + size += 4; crc_ptr = (uint8_t *) &crc; if (shift16) { |