GNS3/dynamips

gt_sdma_handle_rxqueue does not truncate the packet length correctly

flaviojs opened this issue · 2 comments

gt_sdma_handle_rxqueue truncates the value of pkt_len:

dynamips/common/dev_gt.c

Lines 1098 to 1099 in 804ae0c

/* Truncate the packet if it is too big */
pkt_len = m_min(pkt_len,GT_MAX_PKT_SIZE);

but the only use of pkt_len happens before that, in line 1094.

Possible consequence: a big packet might cause a buffer overflow (probably in the vm memory instead of dynamips itself)

Discovered while converting to rust.

gt_eth_handle_rxqueue has the same issue

am79c971_receive_pkthas the same issue