diff options
| -rw-r--r-- | hw/net/net_tx_pkt.c | 2 | ||||
| -rw-r--r-- | hw/net/vmxnet3.c | 4 | ||||
| -rw-r--r-- | hw/net/xilinx_ethlite.c | 4 |
3 files changed, 9 insertions, 1 deletions
diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c index efd43b47b8..53dfaa292c 100644 --- a/hw/net/net_tx_pkt.c +++ b/hw/net/net_tx_pkt.c @@ -590,7 +590,7 @@ static bool net_tx_pkt_do_sw_fragmentation(struct NetTxPkt *pkt, fragment_offset += fragment_len; - } while (more_frags); + } while (fragment_len && more_frags); return true; } diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index bbf44adbcc..90f6943668 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1167,6 +1167,10 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr, { VMXNET3State *s = opaque; + if (!s->device_active) { + return; + } + if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD, VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) { int tx_queue_idx = diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c index 54db2b83bd..35de353b7c 100644 --- a/hw/net/xilinx_ethlite.c +++ b/hw/net/xilinx_ethlite.c @@ -197,6 +197,10 @@ static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size) } D(qemu_log("%s %zd rxbase=%x\n", __func__, size, rxbase)); + if (size > (R_MAX - R_RX_BUF0 - rxbase) * 4) { + D(qemu_log("ethlite packet is too big, size=%x\n", size)); + return -1; + } memcpy(&s->regs[rxbase + R_RX_BUF0], buf, size); s->regs[rxbase + R_RX_CTRL0] |= CTRL_S; |