From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43831) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bUY1X-0005ut-Ik for qemu-devel@nongnu.org; Tue, 02 Aug 2016 07:38:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bUY1T-0003xW-Cm for qemu-devel@nongnu.org; Tue, 02 Aug 2016 07:38:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:35916) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bUY1T-0003xL-6y for qemu-devel@nongnu.org; Tue, 02 Aug 2016 07:38:11 -0400 From: P J P Date: Tue, 2 Aug 2016 17:07:58 +0530 Message-Id: <1470137878-29405-1-git-send-email-ppandit@redhat.com> Subject: [Qemu-devel] [PATCH] net: vmxnet: check fragment length during fragmentation List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Qemu Developers Cc: Jason Wang , Li Qiang , Prasad J Pandit From: Prasad J Pandit VMware VMXNET* NIC emulator supports packet fragmentation. While fragmenting a packet, it checks for more fragments based on packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang Signed-off-by: Prasad J Pandit --- hw/net/vmxnet_tx_pkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c index 91e1e08..f4d0f5f 100644 --- a/hw/net/vmxnet_tx_pkt.c +++ b/hw/net/vmxnet_tx_pkt.c @@ -544,7 +544,7 @@ static bool vmxnet_tx_pkt_do_sw_fragmentation(struct VmxnetTxPkt *pkt, fragment_offset += fragment_len; - } while (more_frags); + } while (fragment_len && more_frags); return true; } -- 2.5.5