Re: [PATCH] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()

2020-03-26 Thread Jason Wang
On 2020/3/27 上午5:11, Peter Maydell wrote: On Tue, 17 Mar 2020 at 06:13, Jason Wang wrote: On 2020/3/13 上午4:16, Peter Maydell wrote: The i82596_receive() function attempts to pass the guest a buffer which is effectively the concatenation of the data it is passed and a 4 byte CRC value. Howev

Re: [PATCH] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()

2020-03-26 Thread Peter Maydell
On Tue, 17 Mar 2020 at 06:13, Jason Wang wrote: > On 2020/3/13 上午4:16, Peter Maydell wrote: > > The i82596_receive() function attempts to pass the guest a buffer > > which is effectively the concatenation of the data it is passed and a > > 4 byte CRC value. However, rather than implementing this

Re: [PATCH] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()

2020-03-17 Thread Helge Deller
On 17.03.20 07:13, Jason Wang wrote: > > On 2020/3/13 上午4:16, Peter Maydell wrote: >> The i82596_receive() function attempts to pass the guest a buffer >> which is effectively the concatenation of the data it is passed and a >> 4 byte CRC value.  However, rather than implementing this as "write >>

Re: [PATCH] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()

2020-03-16 Thread Jason Wang
On 2020/3/13 上午4:16, Peter Maydell wrote: The i82596_receive() function attempts to pass the guest a buffer which is effectively the concatenation of the data it is passed and a 4 byte CRC value. However, rather than implementing this as "write the data; then write the CRC" it instead bumps th

[PATCH] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()

2020-03-12 Thread Peter Maydell
The i82596_receive() function attempts to pass the guest a buffer which is effectively the concatenation of the data it is passed and a 4 byte CRC value. However, rather than implementing this as "write the data; then write the CRC" it instead bumps the length value of the data by 4, and writes 4