Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gt_sdma_handle_rxqueue does not truncate the packet length correctly #247

Open
flaviojs opened this issue Jul 17, 2024 · 2 comments
Open

Comments

@flaviojs
Copy link
Contributor

flaviojs commented Jul 17, 2024

gt_sdma_handle_rxqueue truncates the value of pkt_len:

dynamips/common/dev_gt.c

Lines 1098 to 1099 in 804ae0c

/* Truncate the packet if it is too big */
pkt_len = m_min(pkt_len,GT_MAX_PKT_SIZE);

but the only use of pkt_len happens before that, in line 1094.

Possible consequence: a big packet might cause a buffer overflow (probably in the vm memory instead of dynamips itself)

Discovered while converting to rust.

@flaviojs flaviojs changed the title gt_sdma_handle_rxqueue does not truncate the packet length gt_sdma_handle_rxqueue does not truncate the packet length correctly Jul 17, 2024
@flaviojs
Copy link
Contributor Author

gt_eth_handle_rxqueue has the same issue

@flaviojs
Copy link
Contributor Author

am79c971_receive_pkthas the same issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant