gt_sdma_handle_rxqueue does not truncate the packet length correctly
flaviojs opened this issue · 2 comments
flaviojs commented
gt_sdma_handle_rxqueue
truncates the value of pkt_len:
Lines 1098 to 1099 in 804ae0c
but the only use of pkt_len happens before that, in line 1094.
Possible consequence: a big packet might cause a buffer overflow (probably in the vm memory instead of dynamips itself)
Discovered while converting to rust.
flaviojs commented
gt_eth_handle_rxqueue
has the same issue
flaviojs commented
am79c971_receive_pkt
has the same issue