Skip to content

gt_sdma_handle_rxqueue does not truncate the packet length correctly #247

@flaviojs

Description

@flaviojs

gt_sdma_handle_rxqueue truncates the value of pkt_len:

dynamips/common/dev_gt.c

Lines 1098 to 1099 in 804ae0c

/* Truncate the packet if it is too big */
pkt_len = m_min(pkt_len,GT_MAX_PKT_SIZE);

but the only use of pkt_len happens before that, in line 1094.

Possible consequence: a big packet might cause a buffer overflow (probably in the vm memory instead of dynamips itself)

Discovered while converting to rust.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions