Changeset 85083 in vbox

Timestamp:

Jul 7, 2020 2:34:36 PM (4 years ago)

Author:

vboxsync

Message:

Fix #9766

Location:

trunk/src/VBox/Devices/Network

Files:

• DevVirtioNet.cpp (modified) (1 diff)
• DevVirtioNet_1_0.cpp (modified) (1 diff)

trunk/src/VBox/Devices/Network/DevVirtioNet.cpp

@@ -1289 +1289 @@
                     pGso->cbHdrsTotal = pHdr->u16CSumStart +
                         ((PRTNETTCP)(((uint8_t*)pSgBuf->aSegs[0].pvSeg) + pHdr->u16CSumStart))->th_off * 4;
+                    AssertMsgReturn(pSgBuf->cbUsed > pGso->cbHdrsTotal,
+                        ("cbHdrsTotal exceeds size of frame"), VERR_BUFFER_OVERFLOW);
                     pGso->cbHdrsSeg   = pGso->cbHdrsTotal;
                     break;

trunk/src/VBox/Devices/Network/DevVirtioNet_1_0.cpp

@@ -2307 +2307 @@
                     pGso->cbHdrsTotal = pPktHdr->uChksumStart +
                         ((PRTNETTCP)(((uint8_t*)pSgBuf->aSegs[0].pvSeg) + pPktHdr->uChksumStart))->th_off * 4;
+                    AssertMsgReturn(pSgBuf->cbUsed > pGso->cbHdrsTotal,
+                                    ("cbHdrsTotal exceeds size of frame"), VERR_BUFFER_OVERFLOW);
                     pGso->cbHdrsSeg   = pGso->cbHdrsTotal;
                     break;