tree 62f3850f076bb0ba98ffb6594abeb4d30122f415
parent 9596ef7c7b8528bedb240792ea1fb598543ad3c4
author Prasad J Pandit <pjp@fedoraproject.org> 1448000431 +0530
committer Jason Wang <jasowang@redhat.com> 1449495828 +0800

net: pcnet: add check to validate receive data size(CVE-2015-7504)

In loopback mode, pcnet_receive routine appends CRC code to the
receive buffer. If the data size given is same as the buffer size,
the appended CRC code overwrites 4 bytes after s->buffer. Added a
check to avoid that.

Reported by: Qinghao Tang <luodalongde@gmail.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>