Changeset 41032 in vbox

Timestamp:

Apr 23, 2012 6:39:04 PM (13 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

77594

Message:

E1000: Fixed a potential read beyond TxD cache due to incorrect usage of RT_MIN (#5582)

File:

• trunk/src/VBox/Devices/Network/DevE1000.cpp (modified) (1 diff)

trunk/src/VBox/Devices/Network/DevE1000.cpp

@@ -3224 +3224 @@
 DECLINLINE(unsigned) e1kTxDLoadMore(E1KSTATE* pState)
 {
-    unsigned nDescsToFetch = RT_MIN(e1kGetTxLen(pState), E1K_TXD_CACHE_SIZE - pState->nTxDFetched);
+    unsigned nDescsAvailable = e1kGetTxLen(pState);
+    unsigned nDescsToFetch = RT_MIN(nDescsAvailable, E1K_TXD_CACHE_SIZE - pState->nTxDFetched);
+    /*
+     * It is safe to use TDLEN and TDH in the following expression since TDLEN
+     * is set during init and never changes after that, and TDH is advanced in
+     * the loop we are being called from.
+     */
     unsigned nDescsInSingleRead = RT_MIN(nDescsToFetch, TDLEN / sizeof(E1KTXDESC) - TDH);
     if (nDescsToFetch == 0)