[Qemu-devel] [PATCH] net: smc91c111: check packet number and data register index

[P J P <ppandit@redhat.com>]

From: Prasad J Pandit <pjp@fedoraproject.org>

SMSC91C111 Ethernet interface emulator has registers to store
'packet number' and a 'pointer' to Tx/Rx FIFO buffer area.
These two are used to derive an address to access into 'data'
registers. If they are not set correctly, they could lead to
OOB r/w access beyond packet 'data' area. Add check to avoid it.

Reported-by: Azure Yang <azureyang@tencent.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/net/smc91c111.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index 3b16dcf..2425da1 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -418,7 +418,7 @@ static void smc91c111_writeb(void *opaque, hwaddr offset,
             /* Ignore.  */
             return;
         case 2: /* Packet Number Register */
-            s->packet_num = value;
+            s->packet_num = value & (NUM_PACKETS - 1);
             return;
         case 3: case 4: case 5:
             /* Should be readonly, but linux writes to them anyway. Ignore.  */
@@ -444,7 +444,10 @@ static void smc91c111_writeb(void *opaque, hwaddr offset,
                 } else {
                     p += (offset & 3);
                 }
-                s->data[n][p] = value;
+                if (n < NUM_PACKETS
+                    && p < sizeof(s->data[n]) / sizeof(s->data[n][0])) {
+                    s->data[n][p] = value;
+                }
             }
             return;
         case 12: /* Interrupt ACK.  */
@@ -590,7 +593,12 @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
                 } else {
                     p += (offset & 3);
                 }
-                return s->data[n][p];
+
+                if (n < NUM_PACKETS
+                    && p < sizeof(s->data[n]) / sizeof(s->data[n][0])) {
+                    return s->data[n][p];
+                }
+                return 0x80;
             }
         case 12: /* Interrupt status.  */
             return s->int_level;
-- 
2.7.4