mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
Faraz Vahedi
15198bfd74
virtio_console used the host-supplied used lengths without validation, so a host could report a length larger than the buffer, causing the receive and control paths to read past the end of it. Clamp to the buffer size. vtnet already rejected used lengths larger than the buffer, but performed the check after converting the length to an int, so a length larger than INT_MAX would become negative and bypass the check. Reject such frames early before the conversion, and count them in ierrors and rx_frame_too_large. Reviewed by: markj Approved by: fuz (mentor) Differential Revision: https://reviews.freebsd.org/D60092