From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:33665)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jasowang@redhat.com>) id 1XrLJ8-0006kg-Fr
	for qemu-devel@nongnu.org; Thu, 20 Nov 2014 01:33:39 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jasowang@redhat.com>) id 1XrLJ3-0008Lm-Fu
	for qemu-devel@nongnu.org; Thu, 20 Nov 2014 01:33:34 -0500
Received: from mx1.redhat.com ([209.132.183.28]:51907)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jasowang@redhat.com>) id 1XrLJ3-0008LY-8o
	for qemu-devel@nongnu.org; Thu, 20 Nov 2014 01:33:29 -0500
Message-ID: <546D8B2F.8010908@redhat.com>
Date: Thu, 20 Nov 2014 14:33:19 +0800
From: Jason Wang <jasowang@redhat.com>
MIME-Version: 1.0
References: <1416463034-8264-1-git-send-email-arei.gonglei@huawei.com>
	<1416463034-8264-4-git-send-email-arei.gonglei@huawei.com>
In-Reply-To: <1416463034-8264-4-git-send-email-arei.gonglei@huawei.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: arei.gonglei@huawei.com, qemu-devel@nongnu.org
Cc: pbonzini@redhat.com, peter.huangpeng@huawei.com, stefanha@redhat.com

On 11/20/2014 01:57 PM, arei.gonglei@huawei.com wrote:
> From: Gonglei <arei.gonglei@huawei.com>
>
> s->xmit_pos maybe assigned to a negative value (-1),
> but in this branch variable s->xmit_pos as an index to
> array s->buffer. Let's add a check for s->xmit_pos.
>
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
>  hw/net/pcnet.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
> index d344c15..2bb6417 100644
> --- a/hw/net/pcnet.c
> +++ b/hw/net/pcnet.c
> @@ -1247,7 +1247,7 @@ static void pcnet_transmit(PCNetState *s)
>              s->xmit_pos = -1;
>              goto txdone;
>          }
> -        if (!GET_FIELD(tmd.status, TMDS, ENP)) {
> +        if (!GET_FIELD(tmd.status, TMDS, ENP) && (s->xmit_pos >= 0)) {
>              int bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
>              s->phys_mem_read(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
>                               s->buffer + s->xmit_pos, bcnt, CSR_BSWP(s));

Reviewed-by: Jason Wang <jasowang@redhat.com>