hw/net/net_tx_pkt: Check the payload length
authorAkihiko Odaki <akihiko.odaki@daynix.com>
Thu, 23 Feb 2023 10:20:10 +0000 (19:20 +0900)
committerJason Wang <jasowang@redhat.com>
Fri, 10 Mar 2023 07:35:38 +0000 (15:35 +0800)
commitdd32b5ea7eeea367058ec8e0f9eb41de41a8d106
treedf137bc8ef1777e1294e32456c0d37de2c98424f
parent02ef5fdc092bd495d6afd3c0212ff2e45931886d
hw/net/net_tx_pkt: Check the payload length

Check the payload length if checksumming to ensure the payload contains
the space for the resulting value.

This bug was found by Alexander Bulekov with the fuzzer:
https://patchew.org/QEMU/20230129053316.1071513-1-alxndr@bu.edu/

The fixed test case is:
fuzz/crash_6aeaa33e7211ecd603726c53e834df4c6d1e08bc

Fixes: e263cd49c7 ("Packet abstraction for VMWARE network devices")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
hw/net/net_tx_pkt.c