[Qemu-devel] Stack smash in hw/eepro100.c

[Emil Mikulic <emikulic@gmail.com>]

Hi there,

I've got qemu and kvm crashing when I try to scp data from a VM with
-net nic,model=i82551.  I believe the problem is here:

(hw/eepro100.c, SVN r4892)
 658 static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
[...]
 723             uint8_t buf[MAX_ETH_FRAME_SIZE + 4];
[...]
 745               /* Extended TCB. */
 746               assert(tcb_bytes == 0);
 747               for (; tbd_count < 2; tbd_count++) {
 748                   uint32_t tx_buffer_address = ldl_phys(tbd_address);
 749                   uint16_t tx_buffer_size = lduw_phys(tbd_address + 4); 
 750                   uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
 751                   tbd_address += 8;
 752                   logout
 753                       ("TBD (extended mode): buffer address 0x%08x[...]
 754                        tx_buffer_address, tx_buffer_size);
 755                   cpu_physical_memory_read(tx_buffer_address, &buf[size],
 756                                            tx_buffer_size);
                       ^ KABOOM

What happens is:
 - tbd_count=0, size=0, tx_buffer_size=130
 - tbd_count=1, size=130, tx_buffer_size=1448

130 + 1448 = 1578
sizeof(buf) = 1518

I believe cpu_physical_memory_read() is writing past the end of buf[]
and clobbering the call stack.

I don't know what the right solution is here.

For testing, I made buf[] larger and scp completed without incident
instead of crashing qemu after a few KB.  e.g.:

-                uint8_t buf[MAX_ETH_FRAME_SIZE + 4];
+                uint8_t buf[MAX_ETH_FRAME_SIZE + 1000];

--Emil